Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Embedded Templates Bypass Moderation

Updated 12/1/2025

A jailbreak vulnerability, termed Embedded Jailbreak Template (EJT), allows for the generation of harmful content by bypassing the safety mechanisms of Large Language Models (LLMs). The attack uses a generator LLM to contextually integrate a harmful query into a pre-existing jailbreak template. Unlike fixed templates which insert a query into a static placeholder, EJT rewrites multiple parts of the template to embed the harmful intent naturally. This process preserves the original template's…

Beyond Fixed and Dynamic Prompts: Embedded Jailbreak Templates for Advancing LLM Security

Affects: BERT, DeBERTa v3 Base, GPT-4o

Source: arXiv

EvoSynth: Evolutionary Attack Synthesis

Updated 12/1/2025

Large Language Models (LLMs) are vulnerable to a novel class of jailbreak attacks generated through the evolutionary synthesis of executable, code-based attack algorithms. Unlike traditional methods that refine or combine static prompts, this technique uses an automated multi-agent system (EvoSynth) to autonomously engineer and evolve the underlying code that generates the attack. These generated algorithms exhibit high structural and dynamic complexity, using features like control flow, state…

Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs

Affects: Claude Sonnet 4.5, DeepSeek V3.2 Exp, GPT-4o +7 more

Source: arXiv

Evolutionary Language Model Jailbreak

Updated 12/1/2025

A vulnerability exists in aligned Large Language Models (LLMs) that can be exploited by the FORGEDAN evolutionary framework to bypass safety and alignment mechanisms. The attack, which operates in a black-box setting, uses a genetic algorithm to automatically evolve effective jailbreak prompts. The framework combines multi-strategy textual perturbations (at the character, word, and sentence levels) with a semantic fitness function based on RoBERTa embeddings. This allows it to iteratively…

FORGEDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models

Affects: DeepSeek V3, Gemma 2 9B, Qwen 2.5 7B +2 more

Source: arXiv

Existential Tool Invocation

Updated 12/8/2025

A safety bypass vulnerability exists in Large Language Models (LLMs) and Multi-Modal Models (LVLMs) that expose a "Prefix Completion" parameter in their inference APIs (e.g., echo or prefix parameters). The vulnerability exploits the model's autoregressive nature, where the model prioritizes local coherence with a user-supplied output prefix over global safety alignment (RLHF) or system instructions. By supplying a prefix that establishes a hostile narrative or intent (e.g., "My actions are as…

Can LLMs Threaten Human Survival? Benchmarking Potential Existential Threats from LLMs via Prefix Completion

Affects: DeepSeek V3, Qwen 2.5 7B

Source: arXiv

Game-Theoretic LLM Defection

Updated 12/8/2025

Large Language Models (LLMs) are vulnerable to a black-box jailbreak technique known as the "Game-Theory Attack" (GTA). This vulnerability exploits the model's instruction-following and objective-shaping capabilities by framing the interaction as a finite-horizon sequential stochastic game. By introducing a game-theoretic scenario template—specifically a "Mechanism-Induced Graded Prisoner’s Dilemma"—the attacker alters the model's effective payoff structure. The vulnerability triggers a…

" To Survive, I Must Defect": Jailbreaking LLMs via the Game-Theory Scenarios

Source: arXiv

Guardrail Helpful Mode Jailbreak

Updated 12/30/2025

A "Helpful Mode" role-confusion vulnerability exists in specific Large Language Model (LLM) safety guardrails, specifically Nemotron-Safety-8B and Granite-Guardian-3.2-5B. These models, designed to act as binary classifiers (outputting "Safe" or "Unsafe") for content moderation, can be manipulated via contextually framed adversarial prompts (e.g., academic research requests, corporate security scenarios, or roleplay) to abandon their classification objective. Instead of blocking the request…

Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attacks

Affects: Nemotron Safety 8B, Granite Guardian 3.2 5B

Source: arXiv

ITS Typography Jailbreak

Updated 12/8/2025

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…

Jailbreaking Large Vision Language Models in Intelligent Transportation Systems

Affects: GPT-4o, Qwen 2 7B, LLaVA 7B

Source: arXiv

Indirect Environmental Jailbreak

Updated 12/30/2025

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Affects: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash +3 more

Source: arXiv

LAM Speech Style Jailbreak

Updated 12/8/2025

Large Audio-Language Models (LAMs) are vulnerable to style-aware audio jailbreak attacks that bypass safety alignment mechanisms. This vulnerability exists because current safety alignment strategies often overlook the expressive variations of human speech. Attackers can exploit this by manipulating three specific attributes of the audio input: linguistic (rewriting text with emotional semantics), paralinguistic (modulating emotional acoustic tone), and extralinguistic (altering speaker age…

StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreak

Affects: GPT-4o, Llama 3.1 8B, Qwen 2 7B +1 more

Source: arXiv

LLM App Malicious Drift

Updated 12/8/2025

Improper restriction of the "Capability Space" in Large Language Model (LLM) applications allows remote attackers to manipulate application behavior through "Goal Deviation" attacks. This vulnerability arises when developers rely on the broad capabilities of a foundational model (e.g., GPT-4, LLaMA) without implementing sufficient negative constraints or disabling default plugins (e.g., DALL-E, Web Search) in the system prompt. Attackers can exploit this via natural language inputs to trigger…

Beyond Jailbreak: Unveiling Risks in LLM Applications Arising from Blurred Capability Boundaries

Source: arXiv

Related research categories