{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T20:22:22Z","timestamp":1792786942625,"version":"4.5.0"},"reference-count":83,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Leading Goose\u201d R&D Program of Zhejiang","award":["2024C01169"],"award-info":[{"award-number":["2024C01169"]}]},{"name":"Kunpeng\u2013Ascend Science and Education Innovation Excellence\/Incubation Center"},{"name":"National Natural Science Foundation of China","award":["62441238"],"award-info":[{"award-number":["62441238"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"crossref"}]},{"name":"National Natural Science Foundation of China","award":["U2441240"],"award-info":[{"award-number":["U2441240"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1109\/tpami.2026.3694189","type":"journal-article","created":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T19:49:41Z","timestamp":1779220181000},"page":"11776-11791","source":"Crossref","is-referenced-by-count":0,"title":["EVA: Editing for Versatile Alignment Against Jailbreaks"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-4850-0848","authenticated-orcid":false,"given":"Yi","family":"Wang","sequence":"first","affiliation":[{"name":"ShanghaiTech University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-9729-0782","authenticated-orcid":false,"given":"Hongye","family":"Qiu","sequence":"additional","affiliation":[{"name":"ShanghaiTech University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-0752-0011","authenticated-orcid":false,"given":"Yue","family":"Xu","sequence":"additional","affiliation":[{"name":"ShanghaiTech University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sibei","family":"Yang","sequence":"additional","affiliation":[{"name":"Sun Yat-sen University","place":["Guangzhou, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7872-6969","authenticated-orcid":false,"given":"Zhan","family":"Qin","sequence":"additional","affiliation":[{"name":"Zhejiang University","place":["Hangzhou, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7111-1849","authenticated-orcid":false,"given":"Minlie","family":"Huang","sequence":"additional","affiliation":[{"name":"Tsinghua University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7559-6211","authenticated-orcid":false,"given":"Wenjie","family":"Wang","sequence":"additional","affiliation":[{"name":"ShanghaiTech University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.52202\/068431-2011"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2338"},{"key":"ref3","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.1294"},{"key":"ref5","first-page":"56174","article-title":"Autodan: Generating stealthy Jailbreak prompts on aligned large language models","volume-title":"Proc. 12th Int. Conf. Learn. Representations","author":"Liu"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML64287.2025.00010"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i22.34568"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73464-9_11"},{"key":"ref9","first-page":"62867","article-title":"Safety fine-tuning at (almost) no cost: A baseline for vision large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zong"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3724393"},{"key":"ref11","first-page":"8322","article-title":"LlavaGuard: VLM-based safeguard for vision dataset curation and safety assessment","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","author":"Helff"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72661-3_5"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TASLPRO.2025.3606231"},{"key":"ref14","first-page":"30988","article-title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","volume-title":"Proc. 12fth Int. Conf. Learn. Representations","author":"Qi"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.63317\/2ivv5y3ufu9y"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02325"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.52202\/079017-4322"},{"key":"ref18","article-title":"Finding safety neurons in large language models","author":"Chen","year":"2024"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1233"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177729694"},{"key":"ref21","first-page":"5831","article-title":"Mass-editing memory in a transformer","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Meng"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-demos.9"},{"key":"ref23","first-page":"11465","article-title":"DELMAN: Dynamic defense against large language model Jailbreaking with model editing","volume-title":"Proc. Findings Assoc. Comput. Linguist.: ACL","author":"Wang"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72992-8_22"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1561"},{"key":"ref28","article-title":"LoRA: Low-rank adaptation of large language models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hu","year":"2022"},{"key":"ref29","first-page":"5094","article-title":"Defending large language models against jailbreak attacks via layer-specific editing","volume-title":"Proc. Findings Assoc. Comput. Linguist.: EMNLP","author":"Zhao"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.568"},{"key":"ref31","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1270"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.303"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2651"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.803"},{"key":"ref36","article-title":"Fast model editing at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Mitchell"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.522"},{"key":"ref38","article-title":"Modifying memories in transformer models","author":"Zhu","year":"2020"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-acl.37"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1262"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.171"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-emnlp.450"},{"key":"ref43","article-title":"SafeLLM: Unlearning harmful outputs from large language models against jailbreak attacks","author":"Li","year":"2025"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1240"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0719"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.446"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.3"},{"key":"ref49","article-title":"Glu variants improve transformer","author":"Shazeer","year":"2020"},{"key":"ref50","article-title":"GPT-4o system card","author":"Hurst","year":"2024"},{"key":"ref51","first-page":"74840","article-title":"SparseVLM: Visual token sparsification for efficient vision-language model inference","volume-title":"Proc. 42nd Int. Conf. Mach. Learn.","volume":"2025","author":"Zhang"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00045"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.20"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58452-8_21"},{"key":"ref55","article-title":"Wikimedia downloads","author":"Foundation","year":"2025"},{"key":"ref56","article-title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","volume":"35","author":"Mazeika"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1745"},{"key":"ref58","article-title":"Catastrophic Jailbreak of open-source LLMs via exploiting generation","volume-title":"Proc. 12th Int. Conf. Learn. Representations","author":"Huang"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2020"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N19-1300"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D16-1264"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.130"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.3115\/1119176.1119195"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/11736790_9"},{"key":"ref65","article-title":"Training verifiers to solve math word problems","author":"Cobbe","year":"2021"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-5409"},{"key":"ref68","first-page":"74","article-title":"Rouge: A package for automatic evaluation of summaries","volume-title":"Proc. Workshop Text Summarization Branches Out","author":"Chin-Yew"},{"key":"ref69","article-title":"MM-Vet v2: A challenging benchmark to evaluate large multimodal models for integrated capabilities","author":"Yu","year":"2024"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00913"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.52202\/079017-0850"},{"key":"ref72","article-title":"LLAMA 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023"},{"key":"ref73","article-title":"Mistral 7b. arxiv 2023","author":"Jiang","year":"2024"},{"key":"ref74","article-title":"The llama 3 herd of models","author":"Grattafiori","year":"2024"},{"key":"ref75","article-title":"Qwen2.5 technical report","author":"Yang","year":"2024"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1516"},{"key":"ref77","article-title":"Qwen2. 5-VV technical report","author":"Bai","year":"2025"},{"key":"ref78","article-title":"InternVL3. 5: Advancing open-source multimodal models in versatility, reasoning, and efficiency","author":"Wang","year":"2025"},{"key":"ref79","volume-title":"Matrix Computations","author":"Golub","year":"2013"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/361219.361220"},{"key":"ref81","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tramer"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/0169-7439(87)80084-9"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/18.61115"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11674301\/11523146.pdf?arnumber=11523146","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T17:16:12Z","timestamp":1790270172000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11523146\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":83,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2026.3694189","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10]]}}}