Skip to article frontmatterSkip to article content
Site not loading correctly?

This may be due to an incorrect BASE_URL configuration. See the MyST Documentation for reference.

Bibliography

All academic papers, research blogs, and technical reports referenced throughout the PyRIT documentation.

Citation Keys

Aakanksha et al., 2024Abughallous & Abufakher, 2026Adversa AI, 2023Ahn & Lee, 2025Andriushchenko & Flammarion, 2024Anthropic, 2024Aqrawi & Abbasi, 2024Lin & ATR Community, 2026Banerjee et al., 2025Bethany et al., 2024Bhardwaj & Poria, 2023Bhardwaj et al., 2024Boucher & Anderson, 2023Brahman et al., 2024Bryan et al., 2025Bullwinkel et al., 2025Bullwinkel et al., 2025Bullwinkel et al., 2026Chao et al., 2023Chao et al., 2024Choi et al., 2026Cui et al., 2024Kran et al., 2025Derczynski et al., 2024Ding et al., 2023Dong et al., 2025Rehberger, 2024Rehberger, 2025Gehman et al., 2020Ghosh et al., 2025Ghosh et al., 2025Gong et al., 2025Gupta et al., 2024Haider et al., 2024Han et al., 2024Han et al., 2024HiddenLayer, 2025Hines et al., 2024Huang et al., 2024Hughes et al., 2024Inie et al., 2025Ji et al., 2023Ji et al., 2024Jiang et al., 2025Jones et al., 2025Kingma & Ba, 2014Knight et al., 2025Li et al., 2024Li et al., 2024Li et al., 2024Li et al., 2024Lin et al., 2023Liu et al., 2024Liu et al., 2024Lopez Munoz et al., 2024Luo et al., 2024Lutz et al., 2026Lv et al., 2024Mazeika et al., 2023Mazeika et al., 2024McKee & Noever, 2024Mehrotra et al., 2023Microsoft Security Response Center, 2024Mozilla 0DIN, 2024Palaskar et al., 2025Pfohl et al., 2024Webster, 2025Ren et al., 2024Priyanshu, 2024Roccia, 2024Röttger et al., 2023Röttger et al., 2025Russinovich et al., 2024Russinovich & Salem, 2025Russinovich et al., 2025Scheuerman et al., 2025Shaikh et al., 2022Shayegani et al., 2025Shen et al., 2024Sheshadri et al., 2024Souly et al., 2024Alexandersson, 2023Tan et al., 2026Tang et al., 2025Tedeschi et al., 2024Taylor, 2024Vidgen et al., 2023Wang et al., 2023Wang et al., 2023Wang et al., 2025Wang et al., 2026Wei et al., 2023Xie et al., 2024Yu et al., 2023Yuan et al., 2023Zeng et al., 2024Zeng et al., 2024Zhang et al., 2024Ziems et al., 2022Zong et al., 2024Zou et al., 2023

References
  1. Aakanksha, Ahmadian, A., Ermis, B., Goldfarb-Tarrant, S., Kreutzer, J., Fadaee, M., & Hooker, S. (2024). The Multilingual Alignment Prism: Aligning Global and Local Preferences to Reduce Harm. arXiv Preprint arXiv:2406.18682. https://arxiv.org/abs/2406.18682
  2. Abughallous, A. M., & Abufakher, S. (2026). SemGuard: A Triple-Anchor Semantic Security Gateway for Multilingual Prompt Attack Detection in Large Language Models. 2026 IEEE Jordan Conference on Applied Electrical Engineering and Computing Technologies (AEECT), 143–147. 10.1109/AEECT69724.2026.11657880
  3. Adversa AI. (2023). Universal LLM Jailbreak: ChatGPT, GPT-4, Bard, Bing, Anthropic, and Beyond. https://adversa.ai/blog/universal-llm-jailbreak-chatgpt-gpt-4-bard-bing-anthropic-and-beyond/
  4. Ahn, Y., & Lee, J. (2025). PUZZLED: Jailbreaking LLMs through Word-Based Puzzles. arXiv Preprint arXiv:2508.01306. https://arxiv.org/abs/2508.01306
  5. Andriushchenko, M., & Flammarion, N. (2024). Does Refusal Training in LLMs Generalize to the Past Tense? arXiv Preprint arXiv:2407.11969. https://arxiv.org/abs/2407.11969
  6. Anthropic. (2024). Many-Shot Jailbreaking. https://www.anthropic.com/research/many-shot-jailbreaking
  7. Aqrawi, A., & Abbasi, A. (2024). Well, that escalated quickly: The Single-Turn Crescendo Attack (STCA). arXiv Preprint arXiv:2409.03131. https://arxiv.org/abs/2409.03131
  8. Lin, K.-H., & ATR Community. (2026). ATR: Agent Threat Rules — Open Detection Standard for AI Agent Threats. 10.5281/zenodo.19178002
  9. Banerjee, S., Layek, S., Tripathy, S., Kumar, S., Mukherjee, A., & Hazra, R. (2025). SafeInfer: Context Adaptive Decoding Time Safety Alignment for Large Language Models. https://arxiv.org/abs/2406.12274
  10. Bethany, E., Bethany, M., Flores, J. A. N., Jha, S. K., & Najafirad, P. (2024). Jailbreaking Large Language Models with Symbolic Mathematics. arXiv Preprint arXiv:2409.11445. https://arxiv.org/abs/2409.11445
  11. Bhardwaj, R., & Poria, S. (2023). Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment. arXiv Preprint arXiv:2308.09662. https://arxiv.org/abs/2308.09662
  12. Bhardwaj, R., Anh, D. D., & Poria, S. (2024). Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmetic. arXiv Preprint arXiv:2402.11746. https://arxiv.org/abs/2402.11746
  13. Boucher, N., & Anderson, R. (2023). Trojan Source: Invisible Vulnerabilities. 32nd USENIX Security Symposium (USENIX Security 23), 6507–6524. https://trojansource.codes/
  14. Brahman, F., Kumar, S., Balachandran, V., Dasigi, P., Pyatkin, V., Ravichander, A., Wiegreffe, S., Dziri, N., Chandu, K., Hessel, J., Tsvetkov, Y., Smith, N. A., Choi, Y., & Hajishirzi, H. (2024). The Art of Saying No: Contextual Noncompliance in Language Models. arXiv Preprint arXiv:2407.12043. https://arxiv.org/abs/2407.12043
  15. Bryan, P., Severi, G., de Gruyter, J., Jones, D., Bullwinkel, B., Minnich, A., Chawla, S., Lopez, G., Pouliot, M., Fourney, A., Maxwell, W., Pratt, K., Qi, S., Chikanov, N., Lutz, R., Dheekonda, R. S. R., Jagdagdorj, B.-E., Kim, E., Song, J., … Kumar, R. S. S. (2025). Taxonomy of Failure Mode in Agentic AI Systems. https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Taxonomy-of-Failure-Mode-in-Agentic-AI-Systems-Whitepaper.pdf
PyRIT Documentation
Multi-Turn orchestrators