Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Jailbreak Saturates Alignment Defenses

Updated 4/10/2026

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Generalization Limits of Reinforcement Learning Alignment

Affects: GPT-oss 20B

Source: arXiv

Maladaptive Therapeutic Reinforcement

Updated 4/10/2026

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counseling

Affects: GPT-3.5 Turbo, GPT-5.1, Llama 3.1 8B +5 more

Source: arXiv

Merging Latent Malice

Updated 4/10/2026

A vulnerability in LLM parameter-space merging algorithms enables a latent supply-chain attack where adversaries embed pre-computed malicious weight perturbations into open-source models. Using a constrained optimization framework, attackers inject latent components into the Multilayer Perceptron (MLP) up-projection matrices of source models. These perturbations are mathematically constrained to preserve the source model's individual safety alignment (via directional consistency) and benign…

When Safe Models Merge into Danger: Exploiting Latent Vulnerabilities in LLM Fusion

Affects: Tulu-2-7B, Llama 3.1 Tulu 3 8B DPO, OpenChat 3.5 0106

Source: arXiv

No-Prompt Reasoning Hijack

Updated 4/10/2026

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

Affects: GPT-3.5 Turbo, GPT-4o, GPT-5 +4 more

Source: arXiv

Semantic Masking Image Jailbreak

Updated 4/10/2026

Multiple Text-to-Image (T2I) generation systems and their associated multi-stage moderation pipelines are vulnerable to low-effort semantic obfuscation attacks. Attackers can systematically bypass Input Compliance Checks (ICC), Semantic Safety Checks (SSC), and Post-Generation Moderation (PGM) by embedding restricted concepts into benign natural language contexts. By utilizing techniques such as Material Substitution, Artistic Reframing, Pseudo-Educational Framing, and Ambiguous Action…

Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filters

Affects: Sora, Stable Diffusion v1.4

Source: arXiv

Unsafe Culinary Instructions

Updated 4/10/2026

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models

Affects: Claude 3.7 Sonnet, GPT-4o, GPT-4.1 +8 more

Source: arXiv

Weight Orthogonalization Attack Empowerment

Updated 4/10/2026

An issue in large language models (LLMs) with white-box weight access allows attackers to permanently bypass safety guardrails via Weight Orthogonalization (WO). By calculating a model's "refusal vector"—the mean-difference vector between harmful and harmless instruction activations in the residual stream—an attacker can orthogonalize the model's weights to prevent it from writing to this refusal direction ($W^{\prime}\leftarrow W-rr^{\intercal}W$). Unlike jailbreak-tuning or data poisoning…

Understanding the Effects of Safety Unalignment on Large Language Models

Affects: Qwen 3 4B Instruct 2507, Llama 3.1 8B Instruct, Qwen 2.5 14B +3 more

Source: arXiv

Agent Tool Execution Jailbreak

Updated 4/10/2026

A multi-step tool execution vulnerability exists in Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) or similar tool-calling frameworks. Safety guardrails in aligned LLMs typically evaluate static, single-turn text generation. Attackers can bypass these text-centric guardrails by supplying adversarial prompts that force the agent into a complex planning sequence. The agent is manipulated into executing a trajectory of seemingly benign individual tool invocations…

T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search

Affects: GPT-5, Gemini Pro, DeepSeek V3

Source: arXiv

Agentic Robot Instruction Attack

Updated 4/10/2026

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Source: arXiv

Amnesia Activation Steering Bypass

Updated 4/10/2026

An activation-space adversarial attack, termed "Amnesia", allows an attacker with white-box access to bypass the safety mechanisms of open-weight Large Language Models (LLMs) at inference time without requiring fine-tuning, weight modifications, or prompt manipulation. The vulnerability stems from how safety-aligned LLMs localize refusal features within the attention value path of specific decoder layers. An attacker can extract an attack vector ($\mathbf{V}_i$) by hooking the attention value…

Amnesia: Adversarial Semantic Layer Specific Activation Steering in Large Language Models

Affects: Llama 2 7B, Llama 3 8B, Qwen 2.5 7B

Source: arXiv

Related research categories