{
  "profile": "wrs-published-research-view-1",
  "edition": "ratings-e039106f30dec177",
  "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS",
  "entry": {
    "id": "zou-et-al-gcg-redteam-2023",
    "title": "Zou and colleagues: transferable adversarial stress tests for aligned language models",
    "summary": "Studied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses.",
    "boundary": "This extends earlier discrete prompt-optimization work. Transferability is an empirical result over selected systems and objectives, not universality over all models, inputs or defenses; optimization requires resources and access assumptions.",
    "area": "Adversarial evaluation of language models",
    "topic": "Artificial intelligence",
    "year": 2023,
    "lane": "HUMAN",
    "result": "ALGORITHM",
    "package_id": "zou-et-al-gcg-redteam-2023",
    "target": {
      "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
      "version": 1,
      "content_hash": "sha256:314897cb92fb01a2998a21615592e9d67f50f7528b54b824428250b945513be8"
    },
    "humans": [
      "Andy Zou",
      "Zifan Wang",
      "J. Zico Kolter",
      "Matt Fredrikson"
    ],
    "authors_complete": true,
    "human_role_note": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.",
    "agents": [],
    "related": [],
    "subresults": [],
    "scientific_assessment": {
      "source_review": "SOURCE_CURATED",
      "scientific_review": "NOT_REVIEWED_BY_WRS",
      "formal_replay": "NOT_RUN",
      "provider_attestation": "NONE"
    },
    "sources": [
      {
        "id": "cur20261017-arxiv-2307-15043v1",
        "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
        "url": "https://arxiv.org/abs/2307.15043v1",
        "date": "2023-07-27"
      }
    ],
    "points": "140000",
    "published_grade": {
      "id": "zou-et-al-gcg-redteam-2023",
      "entry_id": "zou-et-al-gcg-redteam-2023",
      "band": "A",
      "modifier": null,
      "target": {
        "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
        "version": 1,
        "content_hash": "sha256:314897cb92fb01a2998a21615592e9d67f50f7528b54b824428250b945513be8"
      },
      "what_changed": "Studied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses.",
      "scope": "Studied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses. This extends earlier discrete prompt-optimization work. Transferability is an empirical result over selected systems and objectives, not universality over all models, inputs or defenses; optimization requires resources and access assumptions.",
      "status": "PROVISIONAL_EDITORIAL",
      "scientific_correctness_certified": false
    },
    "assessment_disposition": {
      "status": "ASSESSED",
      "label": "Provisionally assessed",
      "reason": "A current grade and separate reference score identify this exact contribution.",
      "target": {
        "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
        "version": 1,
        "content_hash": "sha256:314897cb92fb01a2998a21615592e9d67f50f7528b54b824428250b945513be8"
      },
      "edition": "ratings-e039106f30dec177"
    }
  },
  "version": {
    "kind": "PUBLIC_RECORD_VIEW",
    "previous": null,
    "published_at": "2026-10-23T00:00:00Z",
    "publisher": {
      "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33",
      "role": "WRS_EDITORIAL_PUBLICATION"
    },
    "record": {
      "contributors": [
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Andy Zou",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
            "url": "https://arxiv.org/abs/2307.15043v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Zifan Wang",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
            "url": "https://arxiv.org/abs/2307.15043v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "J. Zico Kolter",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
            "url": "https://arxiv.org/abs/2307.15043v1"
          }
        },
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Matt Fredrikson",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
            "url": "https://arxiv.org/abs/2307.15043v1"
          }
        }
      ],
      "evidence": [
        {
          "description": "Bibliographic/stated-result source; not a WRS proof verification",
          "id": "source-0",
          "kind": "source_reference",
          "source": {
            "citation": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
            "url": "https://arxiv.org/abs/2307.15043v1"
          }
        }
      ],
      "origin": "HUMAN_LEGACY",
      "record_profile": "wrs-local-research-notes-0.1",
      "record_type": "research_note",
      "rrp_version": "0.1",
      "scope": {
        "description": "This extends earlier discrete prompt-optimization work. Transferability is an empirical result over selected systems and objectives, not universality over all models, inputs or defenses; optimization requires resources and access assumptions.",
        "domain": "Adversarial evaluation of language models"
      },
      "sources": [
        {
          "citation": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
          "url": "https://arxiv.org/abs/2307.15043v1"
        }
      ],
      "statement": "# Zou and colleagues: transferable adversarial stress tests for aligned language models\n\nStudied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses.\n\n## Scientific scope\n\nThis extends earlier discrete prompt-optimization work. Transferability is an empirical result over selected systems and objectives, not universality over all models, inputs or defenses; optimization requires resources and access assumptions.\n\n## Reading status\n\nThis is a source-linked WRS catalogue note. A full explanatory guide and independent scientific reconstruction have not been completed for this entry. Read the identified original work for its complete narrative and arguments.\n\n## People and systems\n\nAndy Zou; Zifan Wang; J. Zico Kolter; Matt Fredrikson\n\nSource-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.\n\n\n\n## Original sources\n\n- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://arxiv.org/abs/2307.15043v1)\n",
      "summary": "Studied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses.",
      "title": "Zou and colleagues: transferable adversarial stress tests for aligned language models"
    },
    "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
    "version": 1,
    "source_ref": {
      "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
      "version": 1,
      "content_hash": "sha256:314897cb92fb01a2998a21615592e9d67f50f7528b54b824428250b945513be8"
    },
    "export_view": "wrs-public-editorial-view-1",
    "public_view_hash": "sha256:9652a10acc327453f4ec5d472f437469df58c705353d1114918d1ae26eb84ab6"
  },
  "target": {
    "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
    "version": 1,
    "content_hash": "sha256:314897cb92fb01a2998a21615592e9d67f50f7528b54b824428250b945513be8"
  },
  "published_grade": {
    "profile": "wrs-published-grade-1",
    "edition": "2026-10-28.1",
    "id": "zou-et-al-gcg-redteam-2023",
    "entry_id": "zou-et-al-gcg-redteam-2023",
    "revision": 1,
    "title": "Zou and colleagues: transferable adversarial stress tests for aligned language models",
    "context": "Adversarial evaluation of language models",
    "track": "Reusable scientific method, experimental result or historical framework",
    "band": "A",
    "modifier": null,
    "status": "PROVISIONAL_EDITORIAL",
    "assessed_on": "2026-10-23",
    "evidence_cutoff": "2026-10-23",
    "achievement_state": "SUPPORTED_SCOPED_RESULT",
    "what_changed": "Studied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses.",
    "scope": "Studied discrete optimization of adversarial input suffixes across prompts and models, reporting that inputs optimized against accessible models can transfer to some other aligned language models and expose safeguard weaknesses. This extends earlier discrete prompt-optimization work. Transferability is an empirical result over selected systems and objectives, not universality over all models, inputs or defenses; optimization requires resources and access assumptions.",
    "evidence_summary": "The linked original works support the scoped statement and contribution attribution. WRS has not independently replayed experiments or reconstructed a full mathematical proof. This extends earlier discrete prompt-optimization work. Transferability is an empirical result over selected systems and objectives, not universality over all models, inputs or defenses; optimization requires resources and access assumptions.",
    "references": [
      {
        "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
        "url": "https://arxiv.org/abs/2307.15043v1",
        "locator": "Original scoped contribution, statement/method and evidence limits; source-specific attribution retained."
      }
    ],
    "roles": [
      {
        "who": "The named authors in the research record",
        "credit": "SCIENCE",
        "did": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred."
      }
    ],
    "target": {
      "record_id": "urn:uuid:0cb40f95-de09-49ef-abd5-f4ad8c68e2ed",
      "version": 1,
      "content_hash": "sha256:314897cb92fb01a2998a21615592e9d67f50f7528b54b824428250b945513be8"
    },
    "scientific_correctness_certified": false,
    "independent_expert_calibration": false,
    "method": "PROPRIETARY",
    "points": "140000"
  },
  "canonical_agent_submission": false,
  "scientific_verification_awarded": false,
  "reader_guide": null,
  "reading_status": "SOURCE_LINKED_NOTE"
}