Attack Type

Jailbreak Research

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Semantic-Bridging Jailbreaks Reroute Llama-2 Safety Pathways

Published 7/8/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box evaluation in which semantically bridging a benign topic into a harmful request bypassed Llama-2-7B-chat-hf safety behavior in 4 of 30 tested prompt pairs. Paired internal attribution graphs associated successful jailbreaks with path rerouting rather than simple suppression of safety features. This is a paper-reported result, not independently verified here. Defensive reproduction should use the paper’s supplied dataset and code in an isolated…

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Evaluated models: Llama 2 7B Chat

Source: arXiv

Information-Overloading Jailbreaks in Vision-Language Models

Published 7/3/2026

Analyzed 7/20/2026

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Evaluated models: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B +5 more

Source: arXiv

Attention-Head Suppression Bypasses LLM Refusal

Published 6/26/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Evaluated models: Llama 3 8B Instruct, Llama 2 7B Chat, Llama 3 70B Instruct

Source: arXiv

Multilingual Flowchart Jailbreaks in Vision-Language Models

Published 6/5/2026

Analyzed 7/20/2026

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Source: arXiv

Simulated Multi-Turn Priming Bypasses LLM Safety Alignment

Published 5/4/2026

Analyzed 7/21/2026

The paper reports a reproducible black-box jailbreak evaluation in which an evolutionary search generates simulated, role-labeled multi-turn dialogue histories and submits them as a single request. Five semantic mutators and graded judge feedback optimize conversational priming that can induce harmful responses despite direct-request refusals. Results are paper-reported and not independently verified.

ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

Evaluated models: Qwen 3 8B, GPT-oss 20B, GPT-oss 120B +7 more

Source: arXiv

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Published 5/1/2026

Analyzed 7/20/2026

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Evaluated models: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash +3 more

Source: arXiv

Jailbreaks Causally Suppress Refusal Representations

Published 4/30/2026

Analyzed 7/20/2026

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

Evaluated models: Gemma 2 2B IT, Llama 3.1 8B Instruct

Source: arXiv

Agent Goal Reframing Exploit

Published 4/1/2026

Analyzed 4/10/2026

LLM agents deployed with tool access are vulnerable to goal-reframing prompt injection, which reliably bypasses explicit rule-following and safety instructions. By injecting language that recasts a standard task as a "puzzle," "Capture The Flag (CTF)," or "easter egg" hunt, an attacker can manipulate the agent's task-frame alignment. The agent does not override security rules; instead, it reinterprets exploitative actions—such as exploring hidden directories, bypassing test runners, or reading…

Mapping the Exploitation Surface: A 10,000-Trial Taxonomy of What Makes LLM Agents Exploit Vulnerabilities

Evaluated models: Claude Sonnet 4, GPT-4.1, GPT-5 Mini +4 more

Source: arXiv

Agent Implicit Doc Execution

Published 4/1/2026

Analyzed 4/10/2026

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Evaluated models: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5 +2 more

Source: arXiv

Instruction Serialization Leak

Published 4/1/2026

Analyzed 4/10/2026

Large Language Models (LLMs) are vulnerable to system instruction leakage when extraction requests are framed as benign formatting, encoding, or structured-output tasks. While standard alignment and refusal mechanisms successfully block direct queries for system instructions, they fail when attackers request the instructions to be rendered in alternate representations (e.g., YAML, TOML, Base64, or system logs). The model's safety filters misinterpret the request as a harmless transformation or…

Automated Framework to Evaluate and Harden LLM System Instructions against Encoding Attacks

Evaluated models: GPT-4.1 Mini, GPT-3.5 Turbo, Gemini 2.5 Flash +1 more

Source: arXiv

Related research categories