{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,20]],"date-time":"2026-03-20T01:46:56Z","timestamp":1773971216618,"version":"3.50.1"},"reference-count":97,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Natural Sciences and Engineering Research Council of Canada, JST CRONOS","award":["JPMJCS24K8"],"award-info":[{"award-number":["JPMJCS24K8"]}]},{"name":"JSPS KAKENHI","award":["JP21H04877"],"award-info":[{"award-number":["JP21H04877"]}]},{"name":"JSPS KAKENHI","award":["JP23H03372"],"award-info":[{"award-number":["JP23H03372"]}]},{"name":"JSPS KAKENHI","award":["JP24K02920"],"award-info":[{"award-number":["JP24K02920"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Artif. Intell."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tai.2025.3603547","type":"journal-article","created":{"date-parts":[[2025,8,29]],"date-time":"2025-08-29T17:44:47Z","timestamp":1756489487000},"page":"1626-1641","source":"Crossref","is-referenced-by-count":1,"title":["Online Safety Analysis for LLMs: A Benchmark, an Assessment, and a Path Forward"],"prefix":"10.1109","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3981-8515","authenticated-orcid":false,"given":"Xuan","family":"Xie","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Macau University of Science and Technology, Macau, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-7093-9781","authenticated-orcid":false,"given":"Jiayang","family":"Song","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Macau University of Science and Technology, Macau, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9542-4858","authenticated-orcid":false,"given":"Zhehua","family":"Zhou","sequence":"additional","affiliation":[{"name":"University of Macau, Macau, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3666-4020","authenticated-orcid":false,"given":"Yuheng","family":"Huang","sequence":"additional","affiliation":[{"name":"The University of Tokyo, Tokyo, Japan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9267-4229","authenticated-orcid":false,"given":"Da","family":"Song","sequence":"additional","affiliation":[{"name":"Mila - Québec AI Institute, Montréal, QC, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8621-2420","authenticated-orcid":false,"given":"Lei","family":"Ma","sequence":"additional","affiliation":[{"name":"The University of Tokyo, Tokyo, Japan"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Gpt-4 technical report","author":"Achiam","year":"2023"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3491101.3519665"},{"key":"ref3","article-title":"Robots that ask for help: Uncertainty alignment for large language model planners","author":"Ren","year":"2023"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/icra57147.2024.10610065"},{"issue":"1","key":"ref5","first-page":"5485","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2020","journal-title":"J. Mach. Learn. Res."},{"key":"ref6","article-title":"The pile: An 800gb dataset of diverse text for language modeling","author":"Gao","year":"2020"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.2478\/jagi-2014-0001"},{"key":"ref8","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume":"35","author":"Ouyang","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref9","article-title":"Llama guard: LLM-based input-output safeguard for human-AI conversations","author":"Inan","year":"2023"},{"key":"ref10","article-title":"Llama: Open and efficient foundation language models","author":"Touvron","year":"2023"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3571730"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.301"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.464"},{"key":"ref14","article-title":"B.c. lawyer who used fake, AI-generated cases faces law society probe, possible costs","author":"News","year":"2024"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.329"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238202"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454064"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.3233\/faia200375"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88494-9_3"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.23919\/DATE.2019.8714971"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE55969.2022.00047"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA46639.2022.9811924"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2023.3269804"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58920-2_13"},{"key":"ref25","article-title":"A survey of large language models","author":"Zhao","year":"2023"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26752"},{"key":"ref27","article-title":"Purple llama cybersecEval: A secure coding benchmark for language models","author":"Bhatt","year":"2023"},{"key":"ref28","article-title":"Detectors for safe and reliable LLMS: Implementations, uses, and limitations","author":"Achintalwar","year":"2024"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.557"},{"key":"ref30","article-title":"Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Kuhn","year":"2023"},{"key":"ref31","article-title":"TrustLLM: Trustworthiness in large language models","author":"Sun","year":"2024"},{"key":"ref32","article-title":"DecodingTrust: A comprehensive assessment of trustworthiness in GPT models","volume-title":"Proc. 37th Conf. Neural Inf. Process. Syst. Datasets Benchmarks Track","author":"Wang","year":"2023"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.229"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.hcc.2024.100211"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.3115\/1073083.1073135"},{"key":"ref36","doi-asserted-by":"crossref","DOI":"10.18653\/v1\/2023.findings-emnlp.68","article-title":"The internal state of an LLM knows when it\u2019s lying","author":"Azaria","year":"2023"},{"key":"ref37","article-title":"Weakly supervised detection of hallucinations in LLM activations","author":"Rateike","year":"2023"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3411928"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2019.00013"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2024.3519464"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/3477.764879"},{"key":"ref42","article-title":"Augmenting softmax information for selective classification with out-of-distribution data","volume-title":"Proc. Asian Conf. Comput. Vis.","author":"Xia","year":"2022"},{"key":"ref43","article-title":"A baseline for detecting misclassified and out-of-distribution examples in neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2017"},{"key":"ref44","first-page":"7167","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","volume":"31","author":"Lee","year":"2018","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref45","article-title":"Deep anomaly detection with outlier exposure","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2019"},{"key":"ref46","first-page":"5669","article-title":"Doctor: A simple method for detecting misclassification errors","volume":"34","author":"Granese","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/PRDC53464.2021.00012"},{"key":"ref48","article-title":"Neuron activation coverage: Rethinking out-of-distribution detection and generalization","volume-title":"Proc. 12th Int. Conf. Learn. Representations","author":"Liu","year":"2024"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3696630.3728566"},{"key":"ref50","article-title":"Scaling and evaluating sparse autoencoders","author":"Gao","year":"2024"},{"key":"ref51","first-page":"21464","article-title":"Energy-based out-of-distribution detection","volume":"33","author":"Liu","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref52","article-title":"Conjnorm: Tractable density estimation for out-of-distribution detection","volume-title":"Proc. 12th Int. Conf. Learn. Representations","author":"Peng","year":"2024"},{"key":"ref53","article-title":"Plugin estimators for selective classification with out-of-distribution detection","volume-title":"Proc. 12th Int. Conf. Learn. Representations.","author":"Narasimhan","year":"2024"},{"key":"ref54","article-title":"Mosaic: Model-based safety analysis framework for AI-enabled cyber-physical systems","author":"Xie","year":"2023"},{"key":"ref55","article-title":"A data-driven measure of relative uncertainty for misclassification detection","volume-title":"Proc. 12th Int. Conf. Learn. Representations","author":"Gomes","year":"2024"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.65109\/SZFH3482"},{"key":"ref57","article-title":"Systematic rectification of language models via dead-end analysis","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Cao","year":"2023"},{"key":"ref58","article-title":"Controlled decoding from language models","author":"Mudgal","year":"2023"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.623"},{"key":"ref60","article-title":"Online preference alignment for language models via count-based exploration","volume-title":"Proc. 13th Int. Conf. Learn. Representations","author":"Bai","year":"2025"},{"key":"ref61","article-title":"Iterative Nash policy optimization: Aligning LLMs with general preferences via no-regret learning","volume-title":"Proc. 13th Int. Conf. Learn. Representations","author":"Zhang","year":"2025"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3368208"},{"key":"ref63","article-title":"Sparks of artificial general intelligence: Early experiments with GPT-4","author":"Bubeck","year":"2023"},{"key":"ref64","article-title":"Hallucination is inevitable: An innate limitation of large language models","author":"Xu","year":"2024"},{"key":"ref65","article-title":"Jailbreaking ChatGPT via prompt engineering: An empirical study","author":"Liu","year":"2023"},{"key":"ref66","article-title":"Perspective API","year":"2024"},{"key":"ref67","article-title":"Llama 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023"},{"key":"ref68","article-title":"Stanford alpaca: An instruction-following llama model","author":"Taori","year":"2023"},{"key":"ref69","article-title":"Vicuna: An open-source chatbot impressing GPT-4 with 90%* chatGPT quality","author":"Chiang","year":"2023"},{"key":"ref70","article-title":"Sharegpt","year":"2024"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.703"},{"key":"ref72","article-title":"Code llama: Open foundation models for code","author":"Roziere","year":"2023"},{"key":"ref73","first-page":"1877","article-title":"Language models are few-shot learners","volume":"33","author":"Brown","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref74","article-title":"Gpt 3.5","year":"2023"},{"key":"ref75","article-title":"Gpt 4","year":"2024"},{"key":"ref76","article-title":"Alpaca: A strong, replicable instruction-following model","volume-title":"Stanford Center for Research on Foundation Models.","author":"Taori","year":"2023"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-1147"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00276"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1346"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/W14-3302"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.3115\/1073083.1073135"},{"key":"ref82","article-title":"Evaluating large language models trained on code","author":"Chen","year":"2021"},{"key":"ref83","article-title":"Program synthesis with large language models","author":"Austin","year":"2021"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26732"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2005.10.010"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2022.3197693"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177730491.MR0022058.Zbl0041.26103"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.2307\/1165329"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.29172\/7c2a6982-6d72-4cd8-bba6-2fccb06a7011"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1002\/widm.1249"},{"issue":"4","key":"ref91","doi-asserted-by":"crossref","first-page":"259","DOI":"10.1016\/0169-7439(89)80095-4","article-title":"Analysis of variance (Anova)","volume":"6","author":"St","year":"1989","journal-title":"Chemometrics Intell. Lab. Syst."},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/lra.2026.3667488\/mm1"},{"key":"ref93","article-title":"Self-refined large language model as automated reward function designer for deep reinforcement learning in robotics","author":"Song","year":"2023"},{"key":"ref94","article-title":"A prompt pattern catalog to enhance prompt engineering with ChatGPT","author":"White","year":"2023"},{"key":"ref95","article-title":"Q-probe: A lightweight approach to reward maximization for language models","author":"Li","year":"2024"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.158"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.210"}],"container-title":["IEEE Transactions on Artificial Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/9078688\/11417361\/11145129.pdf?arnumber=11145129","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T20:58:49Z","timestamp":1772485129000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11145129\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":97,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tai.2025.3603547","relation":{},"ISSN":["2691-4581"],"issn-type":[{"value":"2691-4581","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}