ai-research-survey

scan.json (29699B)

---

 {
   "paper": {
     "title": "Cognitive Overload Attack: Prompt Injection for Long Context",
     "authors": [
       "Bibek Upadhayay",
       "Vahid Behzadan",
       "Amin Karbasi"
     ],
     "year": 2024,
     "venue": "arXiv preprint",
     "arxiv_id": "2410.11272"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or GitHub link is provided anywhere in the paper. The attack algorithm is described in pseudocode (Algorithm 1) but no executable code is released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses subsets of the Forbidden Question Set and JailbreakBench (both publicly available), but does not release its curated subset of 232 questions, derivative questions generated by GPT-3.5-Turbo, or cognitive load prompts. No data download link is provided."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is provided. The paper mentions using various model APIs but does not specify library versions or environment setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions or README are provided. While the methodology is described in detail (Sections 3-4, Algorithm 1), there are no specific commands or scripts to reproduce the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "No confidence intervals or error bars are reported. The attack success rates (Tables 1, 2) and performance scores (Figure 7) are reported as point estimates without any uncertainty quantification."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.4.2 reports a paired t-test: 't = 3.1248, p = 0.0048' for the decrease in scores across cognitive load levels. Section 3.4.3 also reports 'p<0.05 for both models' for the increase in irrelevant token counts."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Attack success rates are reported with baseline context (e.g., 99.99% for Claude-3-Opus, 90.95% for GPT-4 in Table 1), and performance degradation is shown from CL0 baselines (Figure 7). The ASR values and score drops provide magnitude context comparable to percentage improvements with baselines."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for the sample sizes used (232 questions from Forbidden Question Set, 100 from JailbreakBench, 100 from Vicuna MT Benchmark, 10 for self-reporting). No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across runs. The paper does not mention running experiments multiple times or reporting any measure of result stability. All results appear to be single-run."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper includes CL0 (no cognitive load) as a baseline condition against which all cognitive load levels are compared. Section 3.4.2 uses pairwise comparison between CL0 and each CL combination. The related work section (Section 6) also acknowledges and compares against Xu et al. (2023), a concurrent work on cognitive overload jailbreaking."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The paper tests against state-of-the-art models at the time: GPT-4, Claude-3.5-Sonnet, Claude-3-Opus, Llama-3-70B-Instruct, Gemini-1.0-Pro, and Gemini-1.5-Pro. The comparison with Xu et al. (2023) is contemporary."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper progressively adds cognitive load tasks (CL1 through CL6), effectively ablating the contribution of each task component. Section 3.3 (dual-task approach, App. A.2.1) measures the effect of each individual CL task, and the progressive stacking from CL1 to CL6 shows the incremental contribution of each component."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses multiple evaluation metrics: Attack Success Rate (ASR) across different datasets (Tables 1, 2), pairwise comparison scores (Figure 7), self-reporting CL scores (Figure 11), token count analysis (Figure 14), and qualitative visual evaluation of code generation output (Figures 2-4)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "The paper explicitly acknowledges the absence of human evaluation in Limitation #8: 'Our work is further limited by the absence of human evaluation to assess responses or derivative questions.' All evaluation is automated through LLM judges."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "There is no clear separation of development and test data. The CL combinations (CL7-CL11) for Claude-3.5-Sonnet were crafted through 'experimental trial and error' (Section 4.3, App. A.8), suggesting the test data was used for tuning the attack. No held-out evaluation is described."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1 and 2 provide per-model and per-cognitive-load-level breakdowns of attack success rates. Table 3 and 4 provide additional per-judge-model breakdowns. The Forbidden Question Set categories are described (App. A.6.1), though per-harm-category breakdowns of ASR are not provided."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses the failure of CL1-CL6 against Claude-3.5-Sonnet (Section 4.3), smaller models failing from early CL stages (App. A.4), Gemini models failing to generate code from INTcl onwards (Section 3.4.1), and the lower ASR for Gemini-1.0-Pro (75.43% and 49%). Limitation #7 discusses non-harmful derivative questions."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports several negative results: the initial CL combinations (CL1-CL6) completely failed against Claude-3.5-Sonnet (Section 4.3), the Claude-3.5-Sonnet ASR was only 53% (Table 6), Gemini-1.0-Pro had low ASR of 49% on JailbreakBench (Table 2), and Llama Guard showed effectiveness as a partial defense (App. A.7)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'attack success rates of up to 99.99%' which is technically true for Claude-3-Opus on the Forbidden Question dataset (Table 1), but this cherry-picks the best result. The abstract does not mention the much lower 49% ASR for Gemini-1.0-Pro or the 53% for Claude-3.5-Sonnet. The claim of 'up to' is technically accurate but misleading about the overall effectiveness."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes strong causal claims about cognitive overload causing jailbreaks (e.g., 'cognitive overload—a state where the demand on cognitive processing exceeds the available capacity of the model, leading to potential errors'). However, the analogy between human cognitive load and LLM processing is not empirically validated as causal—the observed performance degradation could have alternative explanations (e.g., attention dilution, context length effects) that do not require invoking cognitive overload as a causal mechanism."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title and framing suggest a general vulnerability in LLMs ('Prompt Injection for Long Context'), but results are from a specific set of 6 models tested with specific CL task combinations. The paper claims broad applicability ('highlighting vulnerabilities in LLMs' ICL') but the attack required completely different prompt designs for Claude-3.5-Sonnet (CL7-CL11), and ASR varied enormously (49-99.99%). These bounds on generalization are not clearly stated in the abstract or conclusion."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper interprets all results through the cognitive load theory lens without seriously considering alternative explanations. The performance degradation with more complex prompts could be explained by simple attention dilution, context window saturation, or instruction-following difficulty rather than 'cognitive overload.' The discussion (Section 5) only discusses competing objectives and mismatched generalization as supporting frameworks, not as alternative explanations to be ruled out."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper lists model names like 'GPT-4', 'Claude-3.5-Sonnet', 'Claude-3-Opus', 'Llama-3-70B-Instruct', 'Gemini-1.0-Pro', and 'Gemini-1.5-Pro' but does not provide specific version identifiers, snapshot dates, or API versions (e.g., 'gpt-4-0613'). Only GPT-3.5-Turbo and GPT-4-Turbo have slightly more specificity but still lack snapshot dates."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides extensive examples of actual prompts used. Figure 5 shows the observation task obfuscation, Figure 6 shows a complete CL5 prompt, Figure 9 shows the judge evaluation prompt, Figure 16 shows the harmfulness evaluation prompt, and Figures 19, 24, 26-31 in the appendix show complete attack prompts for various CL levels."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper specifies temperature=0 for the deterministic setting (Sections 2, 3.2) used in experiments. While other hyperparameters like top-p and max tokens are not mentioned, the temperature setting is the most critical parameter and is explicitly stated."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The attack pipeline is described in detail: Algorithm 1 (App. A.6.1) describes the automated attack algorithm including the iterative CL escalation, judge evaluation loop, and stopping criteria. The derivative question generation process and the multi-judge evaluation pipeline are also documented."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "App. A.6.1 describes the data preprocessing: removing categories 'Political Lobbying', 'Legal Opinion', 'Financial Advice', 'Health Consultation' from the Forbidden Question Set, excluding 'Economic Harm' and 'Pornography' questions deemed harmless, resulting in 232 questions. The derivative question generation process using GPT-3.5-Turbo is also described."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 'Limitations' provides an extensive list of 13 specific limitations of the work, spanning nearly two full pages."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations are specific to this study: Limitation #4 acknowledges the preliminary experiment was limited to a single model (Llama-3-70B-Instruct), #7 discusses non-harmful derivative questions from GPT-3.5-Turbo's safety training, #8 acknowledges the absence of human evaluation, #9 discusses judge LLM bias, #10 discusses the impact of evaluation prompt wording on ASR (SAFE/UNSAFE vs. SAFE/UNSAFE/NEUTRAL)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section explicitly states specific scope boundaries: Limitation #1 (limited set of CL tasks and patterns), #2 (CL limited to specific tags), #3 (task order not explored), #6 (self-reporting limited to 10 questions), #11 (only observation task performance assessed, not CL task performance), #12 (cost increases with cognitive load)."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is made available. The model responses, judge evaluations, derivative questions, and complete attack prompts are not released for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The data collection procedure is described: 232 questions from Forbidden Question Set with specific categories removed (App. A.6.1), 100 questions from JailbreakBench, 100 questions from Vicuna MT Benchmark curated for CL experiments (Section 3.4.2), and 100 science experiment questions created using Claude-3.5-Sonnet (App. A.2.1)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study. All experiments were conducted with LLM APIs."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: original harmful questions -> derivative question generation via GPT-3.5-Turbo -> obfuscation with tags -> combination with CL tasks -> attack on target model -> judge evaluation -> classification as SAFE/UNSAFE/NEUTRAL. Algorithm 1 formalizes this. The filtering of Forbidden Question Set categories and counts (232 questions from original set) are specified."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source or acknowledgments section is present in the paper. There is no mention of any grants, sponsors, or funding agencies."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Bibek Upadhayay and Vahid Behzadan are affiliated with SAIL Lab, University of New Haven; Amin Karbasi is affiliated with Robust Intelligence, CISCO. The corporate affiliation (CISCO/Robust Intelligence) is disclosed."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, making independence impossible to assess. One author (Amin Karbasi) is affiliated with Robust Intelligence (CISCO), a company in the AI safety/security space that could benefit from demonstrations of LLM vulnerabilities. This potential conflict is not discussed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure is provided. One author is affiliated with Robust Intelligence/CISCO, which operates in the AI security domain directly relevant to the paper's findings, but no competing interests declaration is present."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper is a red-teaming/jailbreaking study that tests defense bypass rather than evaluating model capability on a benchmark. The attack exploits prompt design, not model knowledge, so training data contamination is not relevant to the claims."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable for the same reason as above: this is a security/jailbreaking study, not a benchmark evaluation of model knowledge. However, the paper does note (Section 4.1) that derivative questions were paraphrased 'to avoid possible contamination of questions during the safety training of the SOTA models,' showing awareness of a related concern."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable: the study tests adversarial robustness of safety mechanisms, not model performance on knowledge benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper acknowledges cost is relevant (Limitation #12: 'As the cognitive load increases, the attack becomes more costly due to the higher number of tokens generated') and mentions API rate limits (App. A.8), but does not quantify actual API costs, tokens consumed per attack, or wall-clock time."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report total API spend, number of API calls, or total tokens consumed across all experiments despite acknowledging the cost implications."
       }
     }
   },
   "claims": [
     {
       "claim": "Cognitive Load Theory from neuroscience applies to LLMs, and increasing cognitive load degrades LLM performance on secondary tasks similarly to human cognition.",
       "evidence": "Section 3.4.2: Paired t-test showing statistically significant decrease in scores from CLi to CLi+1 (t=3.1248, p=0.0048) on Vicuna MT Benchmark with 100 questions across 4 models. Figures 2-4 show visual degradation of code output. Figure 7 shows average score decline.",
       "supported": "moderate"
     },
     {
       "claim": "Cognitive overload attacks can jailbreak LLMs with attack success rates up to 99.99%.",
       "evidence": "Table 1: Claude-3-Opus achieved 99.99% ASR on Forbidden Question Dataset (232/232 questions). Table 2: Claude-3-Opus achieved 97% ASR on JailbreakBench. However, ASR varies widely: Gemini-1.0-Pro achieved only 75.43% and 49% on the two datasets respectively.",
       "supported": "moderate"
     },
     {
       "claim": "The attack is effective across multiple state-of-the-art models including GPT-4, Claude-3.5 Sonnet, Claude-3 OPUS, Llama-3-70B-Instruct, Gemini-1.0-Pro, and Gemini-1.5-Pro.",
       "evidence": "Tables 1 and 2 show results across 6 models. However, Claude-3.5-Sonnet required entirely different CL combinations (CL7-CL11) designed through trial and error and achieved only 53% ASR (Table 6). The original CL1-CL6 completely failed against Claude-3.5-Sonnet (Section 4.3).",
       "supported": "weak"
     },
     {
       "claim": "Higher-capability models can craft cognitive overload prompts to attack other LLMs, demonstrating transferability.",
       "evidence": "Section 4.4 and App. A.9: Claude-3.5-Sonnet was used to create a CL prompt with an encryption algorithm that successfully jailbroke GPT-4 (Figure 23 shows a successful attack). However, this is a single proof-of-concept example, not a systematic evaluation.",
       "supported": "weak"
     },
     {
       "claim": "Llama Guard-2 8B guardrail completely failed to identify harmful input prompts during cognitive overload attacks.",
       "evidence": "App. A.7: 'All harmful inputs were incorrectly classified as SAFE. Llama Guard failed to identify any harmfulness in our attack input prompt.' For output filtering, Llama Guard achieved up to 45% jailbreak rate (Table 5).",
       "supported": "strong"
     },
     {
       "claim": "Irrelevant token generation increases cognitive load in LLMs.",
       "evidence": "Section 3.4.3: Statistical paired t-test showing significant increase in CL token counts as CL combination increased (p<0.05 for both GPT-4 and Llama-3 tokenizers). Figure 14 shows token count progression.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "The paper proposes a jailbreaking attack inspired by Cognitive Load Theory from neuroscience, demonstrating that adding irrelevant processing tasks before a hidden harmful question can bypass LLM safety mechanisms. Attack success rates ranged from 49% (Gemini-1.0-Pro on JailbreakBench) to 99.99% (Claude-3-Opus on Forbidden Question Dataset), though the attack required significantly different prompt designs for Claude-3.5-Sonnet and achieved only 53% ASR against it. The paper also shows that Llama Guard-2 8B guardrails completely failed to detect harmful inputs when obfuscated with cognitive load tasks, and that LLM performance on secondary tasks degrades progressively with increasing cognitive load.",
   "red_flags": [
     {
       "flag": "Cherry-picked headline result",
       "detail": "The abstract highlights 'up to 99.99%' ASR, which is the single best result (Claude-3-Opus on Forbidden Question Set). ASR ranges from 49% to 99.99% across models and datasets. The 53% ASR on Claude-3.5-Sonnet, requiring entirely different attack prompts, is not mentioned in the abstract."
     },
     {
       "flag": "Anthropomorphic framework without empirical grounding",
       "detail": "The core theoretical contribution—that LLMs experience 'cognitive overload' analogous to humans—is an analogy, not a verified mechanism. The paper does not provide evidence that the same cognitive processes are at work. Performance degradation with complex prompts could be explained by simpler mechanisms (attention dilution, context length limitations, instruction-following difficulty) without invoking cognitive load theory."
     },
     {
       "flag": "No human evaluation of attack outputs",
       "detail": "All evaluation of whether responses are 'harmful' is done by LLM judges. The paper acknowledges this limitation (#8) and notes judge disagreements vary significantly (#9, #10). The evaluation prompt wording affects ASR (SAFE/UNSAFE vs. SAFE/UNSAFE/NEUTRAL). Tables 3-4 show substantial disagreement among additional judge LLMs."
     },
     {
       "flag": "Attack overfitting for Claude-3.5-Sonnet",
       "detail": "The CL1-CL6 attack completely failed against Claude-3.5-Sonnet. New CL7-CL11 combinations were designed through 'experimental trial and error' specifically for this model (App. A.8). This is test-time attack tuning, not a generalizable attack framework."
     },
     {
       "flag": "Single-run results without variance reporting",
       "detail": "All ASR results appear to be from single experimental runs. No repeated trials, no standard deviations, and no indication of result stability. API-based experiments with stochastic models (even at temperature=0, some providers inject randomness) should include multiple runs."
     },
     {
       "flag": "No cost reporting despite high-cost attack",
       "detail": "The attack requires generating thousands of tokens per question across multiple CL levels and models, plus judge evaluations. The paper acknowledges cost as a limitation but never quantifies it, making practical assessment impossible."
     }
   ],
   "cited_papers": [
     {
       "title": "Many-shot jailbreaking",
       "authors": ["Cem Anil", "Esin Durmus", "Mrinank Sharma"],
       "year": 2024,
       "relevance": "Demonstrates jailbreaking through overwhelming models with adversarial examples, a related cognitive overload mechanism."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2023,
       "arxiv_id": "2307.02483",
       "relevance": "Foundational analysis of competing objectives and mismatched generalization in LLM safety, directly cited to explain cognitive overload attack mechanism."
     },
     {
       "title": "Do anything now: Characterizing and evaluating in-the-wild jailbreak prompts on large language models",
       "authors": ["Xinyue Shen", "Zeyuan Chen", "Michael Backes"],
       "year": 2023,
       "arxiv_id": "2308.03825",
       "relevance": "Source of the Forbidden Question Set benchmark used in the paper's evaluation."
     },
     {
       "title": "Jailbreakbench: An open robustness benchmark for jailbreaking large language models",
       "authors": ["Patrick Chao", "Edoardo Debenedetti", "Alexander Robey"],
       "year": 2024,
       "relevance": "Source of the JailbreakBench dataset (100 harmful questions) used in the paper's evaluation."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Comprehensive analysis of prompt injection threats against LLM-integrated applications."
     },
     {
       "title": "More than you've asked for: A comprehensive analysis of novel prompt injection threats to application-integrated large language models",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work on indirect prompt injection threats to LLM-integrated systems."
     },
     {
       "title": "Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking",
       "authors": ["Nan Xu", "Fei Wang", "Ben Zhou"],
       "year": 2023,
       "arxiv_id": "2311.09827",
       "relevance": "Prior concurrent work on cognitive overload jailbreaking with three variants (multilingual, veiled expressions, effect-to-cause reasoning) that this paper extends."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban"],
       "year": 2023,
       "arxiv_id": "2310.08419",
       "relevance": "Automated black-box jailbreaking attack demonstrating that adversarial prompts can be generated with minimal human intervention."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Influential gradient-based adversarial attack on aligned language models demonstrating universal transferability."
     },
     {
       "title": "Llama Guard: LLM-based input-output safeguard for human-AI conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "arxiv_id": "2312.06674",
       "relevance": "The guardrail system evaluated in this paper's attack experiments, showing vulnerability to cognitive overload prompts."
     },
     {
       "title": "Harmbench: A standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin"],
       "year": 2024,
       "arxiv_id": "2402.04249",
       "relevance": "Standardized evaluation framework for red teaming LLMs, one of the sources for JailbreakBench questions."
     },
     {
       "title": "Tree of attacks: Jailbreaking black-box LLMs automatically",
       "authors": ["Anay Mehrotra", "Manolis Zampetakis", "Paul Kassianik"],
       "year": 2023,
       "arxiv_id": "2312.02119",
       "relevance": "Automated jailbreaking framework using tree-based search, relevant to automated adversarial attack methods on LLMs."
     },
     {
       "title": "Sandwich attack: Multi-language mixture adaptive attack on LLMs",
       "authors": ["Bibek Upadhayay", "Vahid Behzadan"],
       "year": 2024,
       "arxiv_id": "2404.07242",
       "relevance": "Related work by the same authors demonstrating language-switching attacks on LLMs, which informs the cognitive load framework."
     }
   ]
 }