Attack Type

Jailbreak Research

Methods for bypassing model safety measures

704 matching entries

Jailbreak research results

704 entries

Adaptive Cipher Jailbreak

Published Jun 27, 2025Analyzed Jul 14, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to obfuscation-based jailbreak attacks using the MetaCipher framework. MetaCipher employs a reinforcement learning algorithm to iteratively select from a pool of 21 ciphers to encrypt malicious keywords within prompts, evading standard safety mechanisms that rely on keyword detection. The framework adaptively learns optimal cipher choices to maximize the success rate of the jailbreak, even against LLMs with reasoning capabilities. Successful attacks…

MetaCipher: A General and Extensible Reinforcement Learning Framework for Obfuscation-Based Jailbreak Attacks on Black-Box LLMs

Evaluated models: Claude 3.7 Sonnet, DeepSeek Chat, DeepSeek R1 +9 more

Hybrid LLM Jailbreak Strategy

Published Jun 27, 2025Analyzed Jul 14, 2025Source: arXiv

A hybrid jailbreak attack, combining gradient-guided token optimization (GCG) with iterative prompt refinement (PAIR or WordGame+), bypasses LLM safety mechanisms resulting in the generation of disallowed content. The hybrid approach leverages the strengths of both techniques, circumventing defenses effective against single-mode attacks. Specifically, the combination of semantically crafted prompts and strategically placed adversarial tokens confuse and overwhelm existing defenses.

Advancing Jailbreak Strategies: A Hybrid Approach to Exploiting LLM Vulnerabilities and Bypassing Modern Defenses

Evaluated models: Llama 2 7B, Llama Guard 2 8B, Mistral 7B +1 more

Variational Jailbreak Inference

Published Jun 27, 2025Analyzed Jul 14, 2025Source: arXiv

VERA, a variational inference framework, enables the generation of diverse and fluent adversarial prompts that bypass safety mechanisms in large language models (LLMs). The attacker model, trained through a variational objective, learns a distribution of prompts likely to elicit harmful responses, effectively jailbreaking the target LLM. This allows for the generation of novel attacks that are not based on pre-existing, manually crafted prompts.

VERA: Variational Inference Framework for Jailbreaking Large Language Models

Evaluated models: Baichuan 2 7B, Gemini Pro, GPT-3.5 Turbo +8 more

Iterative Semantic Jailbreak

Published Jun 20, 2025Analyzed Jul 14, 2025Source: arXiv

The MIST attack exploits a vulnerability in black-box large language models (LLMs) allowing iterative semantic tuning of prompts to elicit harmful responses. The attack leverages synonym substitution and optimization strategies to bypass safety mechanisms without requiring access to the model's internal parameters or weights. The vulnerability lies in the susceptibility of the LLM to semantically similar prompts that trigger unsafe outputs.

MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuning

Evaluated models: Claude 3.5 Sonnet, GPT-4 Turbo, GPT-4o +3 more

Fine-Tuning Safety Subspace Erosion

Published Jun 18, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs) aligned via techniques such as Reinforcement Learning with Human Feedback (RLHF) or Direct Preference Optimization (DPO) contain a vulnerability in how safety features are encoded within the model parameters. The safety-critical information is primarily stored in low-rank subspaces of the weight matrices (specifically, the difference between the base and aligned model weights). These low-rank subspaces are highly sensitive to parameter updates. Consequently…

Lox: Low-rank extrapolation robustifies llm safety against fine-tuning

Evaluated models: GPT-3.5, Llama 2 7B, Mistral 7B

Doppelgänger Agent Hijack

Published Jun 17, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Model (LLM) agents are vulnerable to role consistency collapse and privilege escalation via the "Doppelgänger Method," a prompt-based transferable adversarial attack. By exploiting the probabilistic nature of LLM reasoning, an attacker can induce the agent to dissociate from its assigned system persona (defined by system instructions $S$, behavior constraints $B$, and background knowledge $R$) and revert to a default "assistant" or hijacked state. This vulnerability allows…

Doppelgänger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack

Evaluated models: GPT-4, GPT-4.1, GPT-4.5 Preview +6 more

Alphabet Index Jailbreak

Published Jun 15, 2025Analyzed Jul 14, 2025Source: arXiv

Large Language Models (LLMs) are vulnerable to a novel adversarial attack, Alphabet Index Mapping (AIM), which achieves high success rates in bypassing safety filters ("jailbreaking"). AIM encodes prompts by converting characters to their alphabet indices, maximizing semantic dissimilarity while maintaining straightforward decoding instructions. This allows malicious prompts to evade detection based on semantic similarity, even when the LLM correctly decodes the intent.

Alphabet Index Mapping: Jailbreaking LLMs through Semantic Dissimilarity

Evaluated models: GPT-4

Universal Suffix Attention Hijack

Published Jun 15, 2025Analyzed Dec 30, 2025Source: arXiv

Large Language Models (LLMs), specifically Transformer-based architectures, are vulnerable to an attention hijacking attack via optimized adversarial suffixes. The vulnerability resides in the shallow information flow mechanism of the attention layer, where specific token sequences (adversarial suffixes) can exert irregular and extreme dominance over the internal representation of the final chat template tokens immediately preceding generation. This "hijacking" suppresses the representation of…

Universal Jailbreak Suffixes Are Strong Attention Hijackers

Evaluated models: Gemma 2 2B IT, Qwen 2.5 0.5B Instruct, Qwen 2.5 1.5B Instruct +2 more

Hidden Contextual Bias

Published Jun 12, 2025Analyzed Dec 30, 2025Source: arXiv

Multiple Large Language Models (LLMs), including GPT-4o, Claude 3.5 Sonnet, Gemini 2.5 Flash, Gemma-2 27B, Gemma-3, and Mistral-Small-24B, exhibit a vulnerability where safety guardrails against demographic bias are bypassed through realistic contextual prompting. While prompt-based mitigations effectively suppress bias in simplified, controlled benchmarks, the introduction of realistic hiring contexts—specifically the combination of company culture descriptions (sourced from public career…

Robustly Improving LLM Fairness in Realistic Settings via Interpretability

Evaluated models: GPT-4o, Claude 3.5 Sonnet, Claude Sonnet 4 +5 more

LLM Judge Subversion

Published Jun 11, 2025Analyzed Dec 9, 2025Source: arXiv

Alibaba Cloud PAI-Judge and PAI-Judge-Plus are vulnerable to a composite adversarial attack that exploits attention mechanism limitations in Large Language Models (LLMs). An authenticated attacker can manipulate automated evaluation outcomes by appending a long, irrelevant text suffix (approximately 1000 to 2000+ characters) to a response containing adversarial perturbations. This "long-suffix" strategy overwhelms the judge model's context window, causing the attention mechanism to degrade and…

LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge

Evaluated models: GPT-4o, Llama 3.1 8B, Llama 3.3 70B +3 more

Related research categories