Jailbreaking Aligned Large Language Models: A Systematic Survey of Attack Taxonomies, Evaluation Frameworks, and Defense Mechanisms

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Large language models (LLMs) are now deployed to hundreds of millions of users, and their safe behavior depends on alignment techniques such as supervised fine-tuning and reinforcement learning from human feedback. Yet a class of adversarial inputs known as jailbreaks continues to circumvent these safeguards, eliciting outputs the models were trained to refuse. This paper presents a systematic survey of the jailbreak literature. We formalize the threat model, propose a two-dimensional taxonomy that separates attacks by adversary capability (white-box versus black-box) and by exploitation mechanism, and review representative methods in each category, from gradient-based suffix optimization to persuasion-driven and many-shot techniques. We then examine how the community evaluates attacks and defenses, covering benchmarks, success metrics, and automated judges, and we organize defense strategies into prompt-level, model-level, and system-level interventions. Finally, we identify open challenges — including the generalization of defenses, the security of agentic and multimodal systems, and the limits of current evaluation — and outline directions for future research.