Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Frontier Multi-Turn Jailbreak

Updated 1/14/2026

Frontier Large Language Models (LLMs) exhibit a critical vulnerability to automated, adaptive multi-turn adversarial attacks, specifically those utilizing tree-based exploration algorithms (e.g., the TEMPEST framework). Unlike single-turn jailbreaks, this vulnerability exploits the model's inability to maintain safety alignment across extended conversation trajectories. An attacker using an automated agent can dynamically select from multiple adversarial strategies—such as academic framing…

Replicating TEMPEST at Scale: Multi-Turn Adversarial Attacks Against Trillion-Parameter Frontier Models

Affects: Cogito 2.1, DeepSeek V3.1, Gemma 3 12B +7 more

Source: arXiv

GPT Tool Misuse

Updated 12/8/2025

A vulnerability exists in OpenAI's Custom GPTs platform where the lack of effective isolation between the system context ("Expert Prompt"), external knowledge retrieval, and user input allows for unauthorized information disclosure and tool misuse. By employing specific prompt injection techniques—including Hex injection, Many-shot prefix attacks, and Knowledge Poisoning (uploading malicious files)—an attacker can bypass safety guardrails. This results in the extraction of proprietary system…

An Empirical Study on the Security Vulnerabilities of GPTs

Affects: DALL-E

Source: arXiv

Healthcare Adversarial Consensus

Updated 12/30/2025

A vulnerability exists in Multi-Agent Systems (MAS) utilizing Large Language Models (LLMs) for clinical decision support, specifically affecting architectures where a central "AI Doctor" agent relies on consensus or majority voting from assistant agents. The vulnerability, termed "Many-to-One Adversarial Consensus," allows a coalition of colluding adversarial agents to override the central agent's safety alignment and internal knowledge. By fabricating a false consensus (typically requiring $k…

Many-to-One Adversarial Consensus: Exposing Multi-Agent Collusion Risks in AI-Based Healthcare

Affects: Llama 3.3 70B

Source: arXiv

Knowledge Weaving Jailbreak Tactic

Updated 12/5/2025

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A Wolf in Sheep's Clothing: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search

Affects: Circuit Breaker, Claude 3.5 Haiku, Gemini 2.5 Flash +7 more

Source: arXiv

LLM Psychological Jailbreak

Updated 12/30/2025

Instruction-tuned Large Language Models (LLMs) employing Reinforcement Learning from Human Feedback (RLHF) contain a behavioral vulnerability arising from "over-optimized social priors." This vulnerability, termed Psychological Jailbreak, allows attackers to bypass safety guardrails by exploiting the model’s optimization for anthropomorphic consistency. By establishing a Structured Persona Context (SPC) that aligns with latent psychometric traits (e.g., high agreeableness or neuroticism), an…

Breaking Minds, Breaking Systems: Jailbreaking Large Language Models via Human-like Psychological Manipulation

Affects: GPT-3.5 Turbo, GPT-4o Mini, Gemini 2.0 Flash +2 more

Source: arXiv

Pretrained Leak Jailbreak

Updated 12/30/2025

Large Language Models (LLMs) finetuned from open-weight pretrained sources inherit adversarial vulnerabilities encoded in the pretrained model's internal representations. An attacker with white-box access to a pretrained model (e.g., Llama-2, Llama-3) can identify linearly separable features in the hidden states that correlate with "transferable" jailbreak prompts. By exploiting these features using a Probe-Guided Projection (PGP) attack, the attacker can optimize adversarial suffixes on the…

One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs

Affects: Llama 2 7B Chat, Llama 3 8B Instruct, DeepSeek LLM 7B Chat +5 more

Source: arXiv

Progressive Exposure Jailbreak

Updated 12/30/2025

Large Language Models (LLMs) are vulnerable to a multi-turn adversarial attack framework termed MEEA (Mere Exposure Effect Attack), which exploits the psychological "mere exposure effect" to bypass safety alignment. Unlike single-turn injections, this vulnerability targets the dynamic nature of LLM safety thresholds during sustained interaction. By subjecting the model to a sequence of optimized, low-toxicity, and semantically progressive prompts, an attacker can induce a gradual shift in the…

MEEA: Mere Exposure Effect-Driven Confrontational Optimization for LLM Jailbreaking

Affects: GPT-4, Claude 3.5 Sonnet, Llama 3.1 8B +2 more

Source: arXiv

RL Multi-Turn Jailbreak

Updated 12/30/2025

Large Language Models (LLMs) are vulnerable to automated, black-box, multi-turn jailbreak attacks coordinated by an adversarial agent trained via Reinforcement Learning (RL). The vulnerability exists because standard safety alignments often optimize for single-turn refusals, failing to account for trajectory-level planning. The attack method, dubbed RL-MTJail, utilizes a multi-turn variant of Group Relative Policy Optimization (GRPO) to train an attacker LLM. This agent optimizes for the…

RL-MTJail: Reinforcement Learning for Automated Black-Box Multi-Turn Jailbreaking of Large Language Models

Affects: GPT-4o, Llama 2 13B, Llama 3.1 8B +3 more

Source: arXiv

Reject-Accept Judge Flip

Updated 12/30/2025

"LLM-as-a-Judge" systems and automated scientific review frameworks (such as OpenReviewer, DeepReview, and institutional deployments like AAAI’s AI-powered assessment) are vulnerable to Indirect Prompt Injection via adversarial PDF manipulation. Attackers can embed hidden instructions—specifically using white font (1pt) or obfuscated semantics—within submission documents. When these PDFs are parsed (typically via OCR or tools like MinerU converting to Markdown) and processed by the LLM, the…

When Reject Turns into Accept: Quantifying the Vulnerability of LLM-Based Scientific Reviewers to Indirect Prompt Injection

Affects: Tülu 3 8B, Llama 3.1 8B, Falcon 3 10B +10 more

Source: arXiv

Safe-to-Harm Response Rewrite

Updated 12/30/2025

Large Language Models (LLMs), including GPT-5, Gemini-2.5-Flash, DeepSeek, and Llama-3, are vulnerable to a semantic isomorphism attack known as "Safe2Harm." This vulnerability arises from the failure of safety alignment mechanisms (SFT, RLHF, DPO) to detect harmful underlying principles when they are encapsulated within semantically legitimate scenarios. Attackers can bypass safety filters through a four-stage process: (1) rewriting a harmful query into a safe, principle-equivalent query…

Safe2Harm: Semantic Isomorphism Attacks for Jailbreaking Large Language Models

Affects: Qwen 3 1.7B, Qwen 3 4B, Qwen 3 8B +3 more

Source: arXiv

Related research categories