Attack Type

Jailbreak Research

Methods for bypassing model safety measures

348 matching entries out of 704 in this category

Jailbreak research results

348 entries

Boilerplate safety tuning causes false refusals on benign requests

Published Sep 4, 2026Analyzed Sep 9, 2026Source: arXiv

Controlled safety-tuning experiments link boilerplate refusal statements to unnecessary refusals of benign requests. Request-specific rationales improve benign compliance, with benchmark-dependent safety tradeoffs.

Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models

Evaluated models: Llama 3.1 8B, Mistral 7B v0.3, Gemma 2 9B+9 more

Llama 3.1 8B
Mistral 7B v0.3
Gemma 2 9B
Qwen 2.5 7B
Gemma 2 2B
Qwen 2.5 3B
Llama 3.1 70B
Qwen 2.5 72B
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3
Gemma 2 9B IT
Qwen 2.5 7B Instruct

Semantic-Bridging Jailbreaks Reroute Llama-2 Safety Pathways

Published Jul 8, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible white-box evaluation in which semantically bridging a benign topic into a harmful request bypassed Llama-2-7B-chat-hf safety behavior in 4 of 30 tested prompt pairs. Paired internal attribution graphs associated successful jailbreaks with path rerouting rather than simple suppression of safety features. This is a paper-reported result, not independently verified here. Defensive reproduction should use the paper’s supplied dataset and code in an isolated…

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Evaluated models: Llama 2 7B Chat

Information-Overloading Jailbreaks in Vision-Language Models

Published Jul 3, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Evaluated models: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B+5 more

Qwen3-VL 8B
Qwen2-VL-7B
InternVL3.5-8B
InternVL 2 8B
Llama 3.2 11B Vision
GPT-4.1 Mini
Gemini 2.5 Flash
Gemini 2.5 Flash-Lite

Attention-Head Suppression Bypasses LLM Refusal

Published Jun 26, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible white-box jailbreak failure mode: successful jailbreak templates selectively suppress early-layer Adversarially Compromised Heads (ACHs), bypassing refusal while harmful-semantic safety activations persist in other heads. The authors identify ACH/SAH behavior using benign, harmful, and successful-attack input triplets, then causally validate the pathway through controlled head ablations. Safe defensive reproduction should use the paper’s released evaluation…

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Evaluated models: Llama 3 8B Instruct, Llama 2 7B Chat, Llama 3 70B Instruct

Multilingual Flowchart Jailbreaks in Vision-Language Models

Published Jun 5, 2026Analyzed Jul 20, 2026Source: arXiv

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Published May 1, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Evaluated models: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash+3 more

GPT-5.2
Claude Haiku 4.5
Gemini 3 Flash
Gemini 3.1 Pro
Qwen3-VL-235B
Qwen3-VL-32B

Jailbreaks Causally Suppress Refusal Representations

Published Apr 30, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible white-box evaluation showing that successful jailbreak prompts can alter a safety-aligned model’s intermediate representations so harmful requests no longer trigger refusal. Its LOCA method identifies small, token-specific residual-stream changes that restore refusal on individual successful jailbreaks, providing causal evidence that jailbreak success can depend on suppressing harmfulness/refusal concepts or strengthening seemingly harmless continuation…

Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

Evaluated models: Gemma 2 2B IT, Llama 3.1 8B Instruct

Maladaptive Therapeutic Reinforcement

Published Apr 6, 2026Analyzed Apr 10, 2026Source: arXiv

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counseling

Evaluated models: GPT-3.5 Turbo, GPT-5.1, Llama 3.1 8B+5 more

GPT-3.5 Turbo
GPT-5.1
Llama 3.1 8B
Llama 3.1 70B
Crispers 7B
Psycho 8B
Qwen 3 14B
Qwen 2.5 72B

Jailbreak Saturates Alignment Defenses

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Generalization Limits of Reinforcement Learning Alignment

Evaluated models: GPT-oss 20B

Weight Orthogonalization Attack Empowerment

Published Apr 2, 2026Analyzed Apr 10, 2026Source: arXiv

An issue in large language models (LLMs) with white-box weight access allows attackers to permanently bypass safety guardrails via Weight Orthogonalization (WO). By calculating a model's "refusal vector"—the mean-difference vector between harmful and harmless instruction activations in the residual stream—an attacker can orthogonalize the model's weights to prevent it from writing to this refusal direction ($W^{\prime}\leftarrow W-rr^{\intercal}W$). Unlike jailbreak-tuning or data poisoning…

Understanding the Effects of Safety Unalignment on Large Language Models

Evaluated models: Qwen 3 4B Instruct 2507, Llama 3.1 8B Instruct, Qwen 2.5 14B+3 more

Qwen 3 4B Instruct 2507
Llama 3.1 8B Instruct
Qwen 2.5 14B
Qwen 3 4B Thinking 2507
DeepSeek R1 Distill Llama 8B
DeepSeek R1 Distill Qwen 14B

Related research categories