{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T19:40:04Z","timestamp":1785526804652,"version":"3.56.0"},"reference-count":36,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Australian Research Council (ARC), Australia,","award":["LP220100453"],"award-info":[{"award-number":["LP220100453"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3707452","type":"journal-article","created":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T19:43:39Z","timestamp":1782416619000},"page":"6944-6957","source":"Crossref","is-referenced-by-count":0,"title":["Ellipsoid Control: A White-List Jailbreak Defense via Benign Latent Modeling"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-5746-9817","authenticated-orcid":false,"given":"Luoyu","family":"Chen","sequence":"first","affiliation":[{"name":"University of Technology Sydney","place":["Sydney, NSW, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7905-3126","authenticated-orcid":false,"given":"Weiqi","family":"Wang","sequence":"additional","affiliation":[{"name":"Xi\u2019an Jiaotong University","place":["Xi\u2019an, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8905-0941","authenticated-orcid":false,"given":"Zhiyi","family":"Tian","sequence":"additional","affiliation":[{"name":"Southeast University","place":["Jiangsu, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Feng","family":"Wu","sequence":"additional","affiliation":[{"name":"University of Technology Sydney","place":["Sydney, NSW, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1866-0123","authenticated-orcid":false,"given":"Ahmed","family":"Asiri","sequence":"additional","affiliation":[{"name":"University of Technology Sydney","place":["Sydney, NSW, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4485-6743","authenticated-orcid":false,"given":"Shui","family":"Yu","sequence":"additional","affiliation":[{"name":"University of Technology Sydney","place":["Sydney, NSW, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023","journal-title":"arXiv:2302.13971"},{"key":"ref2","article-title":"GPT-4 technical report","volume-title":"arXiv:2303.08774","author":"Achiam","year":"2023"},{"key":"ref3","article-title":"Qwen technical report","volume-title":"arXiv:2309.16609","author":"Bai","year":"2023"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1143"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2945367"},{"key":"ref6","first-page":"3819","article-title":"Scalable zero-knowledge proofs for non-linear functions in machine learning","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Hao"},{"key":"ref7","article-title":"Jailbreak attacks and defenses against large language models: A survey","author":"Yi","year":"2024","journal-title":"arXiv:2407.04295"},{"key":"ref8","first-page":"1","article-title":"Improving alignment and robustness with circuit breakers","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst","author":"Zou"},{"key":"ref9","article-title":"Latent adversarial training improves robustness to persistent harmful behaviors in LLMs","author":"Sheshadri","year":"2024","journal-title":"arXiv:2407.15549"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.52202\/079017-4322"},{"key":"ref11","article-title":"Jailbreak antidote: Runtime safety-utility balance via sparse representation adjustment in large language models","author":"Shen","year":"2024","journal-title":"arXiv:2410.02298"},{"key":"ref12","first-page":"1","article-title":"Programming refusal with conditional activation steering","volume-title":"Proc. 13th Int. Conf. Learn. Represent. (ICLR)","author":"Lee"},{"key":"ref13","first-page":"1","article-title":"Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst","author":"Schwinn"},{"key":"ref14","article-title":"OR-bench: An over-refusal benchmark for large language models","author":"Cui","year":"2024","journal-title":"arXiv:2405.20947"},{"key":"ref15","first-page":"1","article-title":"HarmBench: A standardized evaluation framework for automated red teaming and robust refusal","volume-title":"Proc. 41st Int. Conf. Mach. Learn. (ICML)","author":"Mazeika"},{"key":"ref16","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023","journal-title":"arXiv:2309.00614"},{"key":"ref17","article-title":"Defending large language models against jailbreak attacks via semantic smoothing","author":"Ji","year":"2024","journal-title":"arXiv:2402.16192"},{"key":"ref18","article-title":"SmoothLLM: Defending large language models against jailbreaking attacks","author":"Robey","year":"2023","journal-title":"arXiv:2310.03684"},{"key":"ref19","article-title":"Defending against alignment-breaking attacks via robustly aligned LLM","author":"Cao","year":"2023","journal-title":"arXiv:2309.14348"},{"key":"ref20","article-title":"Intention analysis makes LLMs a good jailbreak defender","author":"Zhang","year":"2024","journal-title":"arXiv:2401.06561"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.52202\/079017-4011"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.30"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3701716.3717659"},{"key":"ref24","article-title":"HiddenDetect: Detecting jailbreak attacks against large vision-language models via monitoring hidden states","author":"Jiang","year":"2025","journal-title":"arXiv:2502.14744"},{"key":"ref25","article-title":"Mistral 7B","author":"Jiang","year":"2023","journal-title":"arXiv:2310.06825"},{"key":"ref26","article-title":"Qwen2.5 technical report","volume-title":"arXiv:2412.15115","author":"Yang","year":"2024"},{"key":"ref27","article-title":"The llama 3 herd of models","author":"Grattafiori","year":"2024","journal-title":"arXiv:2407.21783"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.183"},{"key":"ref29","article-title":"Measuring massive multitask language understanding","author":"Hendrycks","year":"2020","journal-title":"arXiv:2009.03300"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2020"},{"key":"ref31","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"},{"key":"ref32","article-title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","author":"Liu","year":"2023","journal-title":"arXiv:2310.04451"},{"key":"ref33","article-title":"GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts","author":"Yu","year":"2023","journal-title":"arXiv:2309.10253"},{"key":"ref34","article-title":"Jailbreaking black box large language models in twenty queries","author":"Chao","year":"2023","journal-title":"arXiv:2310.08419"},{"key":"ref35","volume-title":"Breaking Circuit Breakers","author":"Thompson","year":"2025"},{"key":"ref36","article-title":"AlphaSteer: Learning refusal steering with principled null-space constraint","author":"Sheng","year":"2025","journal-title":"arXiv:2506.07022"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11579269.pdf?arnumber=11579269","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T18:03:45Z","timestamp":1785521025000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11579269\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":36,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3707452","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}