Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

Adversarial Poetry Jailbreak

Published Nov 19, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs) from multiple vendors are vulnerable to a "poetic jailbreak" attack, a form of stylistic obfuscation where safety guardrails are bypassed by formatting harmful requests as poetry. By encoding prohibited instructions (e.g., malware creation, CBRN protocols) into verse—utilizing metaphors, rhyme schemes, and rhythmic structure—an attacker can evade intent recognition heuristics. The model perceives the input primarily as a creative writing constraint rather than a…

Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models

Evaluated models: DeepSeek Chat V3.1, DeepSeek V3.2 Exp, Qwen 3 32B+22 more

DeepSeek Chat V3.1
DeepSeek V3.2 Exp
Qwen 3 32B
Gemini 2.5 Flash
Kimi K2
Gemini 2.5 Pro
Gemini 2.5 Flash-Lite
DeepSeek R1
Magistral Medium 2506
Qwen 3 Max
Mistral Large 2411
Mistral Small 3.2 24B Instruct
Llama 4 Maverick
Llama 4 Scout
Kimi K2 Thinking
Grok 4 Fast
GPT-oss 20B
Grok 4
GPT-oss 120B
Claude Sonnet 4.5
GPT-5
Claude Opus 4.1
GPT-5 Mini
GPT-5 Nano
Claude Haiku 4.5

Conceptual Triggers Bypass Safety

Published Nov 19, 2025Analyzed Dec 5, 2025Source: arXiv

Large Language Models are vulnerable to a conceptual manipulation attack, termed Morphology Inspired Conceptual Manipulation (MICM), that bypasses standard safety filters to generate content aligned with harmful extremist ideologies. The attack does not use explicit keywords or standard jailbreak syntax. Instead, it embeds a curated set of seemingly innocuous phrases, called Concept-embedded Triggers (CETs), into a prompt template. These CETs represent an abstract "conceptual configuration" of…

When Harmless Words Harm: A New Threat to LLM Safety via Conceptual Triggers

Evaluated models: DeepSeek R1, DeepSeek V3, GPT-4o+3 more

DeepSeek R1
DeepSeek V3
GPT-4o
GPT-4o Mini
Mistral 7B v0.3
Qwen 3 8B

Embedded Templates Bypass Moderation

Published Nov 18, 2025Analyzed Dec 1, 2025Source: arXiv

A jailbreak vulnerability, termed Embedded Jailbreak Template (EJT), allows for the generation of harmful content by bypassing the safety mechanisms of Large Language Models (LLMs). The attack uses a generator LLM to contextually integrate a harmful query into a pre-existing jailbreak template. Unlike fixed templates which insert a query into a static placeholder, EJT rewrites multiple parts of the template to embed the harmful intent naturally. This process preserves the original template's…

Beyond Fixed and Dynamic Prompts: Embedded Jailbreak Templates for Advancing LLM Security

Evaluated models: BERT, DeBERTa v3 Base, GPT-4o

Evolutionary Language Model Jailbreak

Published Nov 17, 2025Analyzed Dec 1, 2025Source: arXiv

A vulnerability exists in aligned Large Language Models (LLMs) that can be exploited by the FORGEDAN evolutionary framework to bypass safety and alignment mechanisms. The attack, which operates in a black-box setting, uses a genetic algorithm to automatically evolve effective jailbreak prompts. The framework combines multi-strategy textual perturbations (at the character, word, and sentence levels) with a semantic fitness function based on RoBERTa embeddings. This allows it to iteratively…

FORGEDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models

Evaluated models: DeepSeek V3, Gemma 2 9B, Qwen 2.5 7B+2 more

DeepSeek V3
Gemma 2 9B
Qwen 2.5 7B
RoBERTa
Transpec 13B

ITS Typography Jailbreak

Published Nov 17, 2025Analyzed Dec 8, 2025Source: arXiv

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…

Jailbreaking Large Vision Language Models in Intelligent Transportation Systems

Evaluated models: GPT-4o, Qwen 2 7B, LLaVA 7B

Black-Box Graph-Text Node Injection

Published Nov 16, 2025Analyzed Feb 21, 2026Source: arXiv

LLM-enhanced Graph Neural Networks (GNNs), which integrate Large Language Model (LLM) feature encoders with graph message-passing architectures, are vulnerable to a black-box node injection attack known as "GraphTextack." This vulnerability exists because the joint model architecture creates a dual attack surface: the GNN component is sensitive to structural perturbations (changes in graph topology), while the LLM component is sensitive to semantic perturbations (adversarial phrasing).

GRAPHTEXTACK: A Realistic Black-Box Node Injection Attack on LLM-Enhanced GNNs

Evaluated models: Llama 2 7B

EvoSynth: Evolutionary Attack Synthesis

Published Nov 16, 2025Analyzed Dec 1, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to a novel class of jailbreak attacks generated through the evolutionary synthesis of executable, code-based attack algorithms. Unlike traditional methods that refine or combine static prompts, this technique uses an automated multi-agent system (EvoSynth) to autonomously engineer and evolve the underlying code that generates the attack. These generated algorithms exhibit high structural and dynamic complexity, using features like control flow, state…

Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs

Evaluated models: Claude Sonnet 4.5, DeepSeek V3.2 Exp, GPT-4o+7 more

Claude Sonnet 4.5
DeepSeek V3.2 Exp
GPT-4o
GPT-5 Chat
Llama 3.1 70B Instruct
Llama 3.1 8B Instruct
Llama Guard 2 8B
Llama Guard 3 8B
Llama Guard 4 12B
Qwen Max

LLM Elder Fraud Pipeline

Published Nov 13, 2025Analyzed Dec 8, 2025Source: arXiv

Large Language Models (LLMs) from multiple vendors exhibit vulnerabilities to jailbreaking techniques that bypass safety guardrails, enabling the automated generation of highly persuasive phishing content specifically targeted at elderly victims. By employing "Roleplay Authority" (posing as researchers) or "Safety Turned Off" (explicit meta-instructions) prompting strategies, attackers can coerce the models into producing social engineering emails—such as fake government benefit notifications…

Can AI Models be Jailbroken to Phish Elderly Victims? An End-to-End Evaluation

Evaluated models: GPT-5, Claude Sonnet 4, Gemini 2.5 Pro+3 more

GPT-5
Claude Sonnet 4
Gemini 2.5 Pro
Grok 4
DeepSeek Chat V3.1
Llama 4 Maverick

Linguistic Style Jailbreak

Published Nov 13, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to Linguistic Style Jailbreaks, a technique where an attacker reframes a harmful prompt using specific linguistic tones—such as politeness, fear, curiosity, or compassion—to bypass safety guardrails. While standard safety alignment (RLHF) effectively filters harmful requests phrased in neutral or hostile tones, it fails to generalize to prompts where the semantic intent remains harmful but the stylistic framing triggers compliant, helpful, or…

Say It Differently: Linguistic Styles as Jailbreak Vectors

Evaluated models: Llama 3.1 8B Instruct, Llama 3.2 1B Instruct, Llama 3.2 3B Instruct+13 more

Llama 3.1 8B Instruct
Llama 3.2 1B Instruct
Llama 3.2 3B Instruct
Llama 3.3 70B Instruct
Qwen 2.5 0.5B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 7B Instruct
Qwen 2.5 14B Instruct
Qwen 2.5 32B Instruct
Qwen 2.5 72B Instruct
Ministral 8B Instruct 2410
Phi-4 Mini Instruct
Command R+
GPT-4o Mini
Grok 4

Speech-Audio Composition Attack

Published Nov 13, 2025Analyzed Dec 30, 2025Source: arXiv

Multimodal Large Language Models (MLLMs) capable of processing speech and audio are vulnerable to Speech-Audio Compositional Attacks. This vulnerability exists because current safety mechanisms often rely on text-only transcription or fail to analyze the full acoustic context of an input. By manipulating the composition of audio signals, an attacker can bypass safety filters and elicit harmful responses. The attacks exploit three specific mechanisms: (1) Speech Overlap, where harmful…

Speech-Audio Compositional Attacks on Multimodal LLMs and Their Defense with SALMONN-Guard

Evaluated models: Qwen2-Audio 7B, Qwen 2.5 Omni 7B, Step-Audio 2 Mini Base+6 more

Qwen2-Audio 7B
Qwen 2.5 Omni 7B
Step-Audio 2 Mini Base
MiniCPM-o 2.6 8B
Qwen3-Omni 30B-A3B Instruct
Kimi-Audio 7B Instruct
Gemini 1.5 Pro
GPT-4o
Gemini 2.5 Pro

Related research categories