Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Alphabet Index Jailbreak

Updated 7/14/2025

Large Language Models (LLMs) are vulnerable to a novel adversarial attack, Alphabet Index Mapping (AIM), which achieves high success rates in bypassing safety filters ("jailbreaking"). AIM encodes prompts by converting characters to their alphabet indices, maximizing semantic dissimilarity while maintaining straightforward decoding instructions. This allows malicious prompts to evade detection based on semantic similarity, even when the LLM correctly decodes the intent.

Alphabet Index Mapping: Jailbreaking LLMs through Semantic Dissimilarity

Affects: GPT-4

Source: arXiv

Bitstream Camouflage Jailbreak

Updated 7/14/2025

A novel black-box attack, dubbed BitBypass, exploits the vulnerability of aligned LLMs by camouflaging harmful prompts using hyphen-separated bitstreams. This bypasses safety alignment mechanisms by transforming sensitive words into their bitstream representations and replacing them with placeholders, in conjunction with a specially crafted system prompt that instructs the LLM to convert the bitstream back to text and respond as if given the original harmful prompt.

BitBypass: A New Direction in Jailbreaking Aligned Large Language Models with Bitstream Camouflage

Affects: Claude 3.5 Sonnet, Gemini 1.5 Pro, GPT-4o +2 more

Source: arXiv

Chain-of-Code Collapse

Updated 12/30/2025

Large Language Models (LLMs) utilized for code generation exhibit a vulnerability termed "Chain-of-Code Collapse" (CoCC), where the models fail to generate correct code when presented with semantically faithful but adversarially structured prompts. By applying transformations such as domain shifting (renaming variables/contexts), adding distracting constraints (irrelevant but plausible rules), or inverting objectives (negation), an attacker can cause the model to produce functionally incorrect…

Chain-of-Code Collapse: Reasoning Failures in LLMs via Adversarial Prompting in Code Generation

Affects: Gemini 2.5 Flash Preview, Gemini 2.0 Flash, Claude 3.7 Sonnet +5 more

Source: arXiv

Combined Malicious Code Jailbreak

Updated 12/8/2025

Mainstream Large Language Models (LLMs), including DeepSeek-R1, GPT-4o, Llama-3.3-70B-Instruct, and Qwen-Coder, are vulnerable to black-box jailbreak attacks that bypass safety alignment mechanisms to generate functional malicious code. The vulnerability is exploited through specific prompt engineering techniques, most notably "Benign Expression" (substituting malicious keywords with harmless synonyms) and "DRA" (Decomposed Requirement Attack), which conceal malicious intent within seemingly…

LLMs Caught in the Crossfire: Malware Requests and Jailbreak Challenges

Affects: Claude 3.5 Sonnet 20240620, GPT-4o Preview 20240801, GPT-4o Mini 2024-07-18 +26 more

Source: arXiv

Distilled Jailbreak Attacks

Updated 7/14/2025

A vulnerability in Large Language Models (LLMs) allows adversarial prompt distillation from a large language model (LLM) to a smaller language model (SLM), enabling efficient and stealthy jailbreak attacks. The attack leverages knowledge distillation techniques, reinforcement learning, and dynamic temperature control to transfer the LLM's ability to bypass safety mechanisms to a smaller, more easily deployable SLM. This allows for lower computational cost attacks with a potentially high…

Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMs

Affects: BERT Base, Gemma 2 27B, Gemma 2 2B +8 more

Source: arXiv

Doppelgänger Agent Hijack

Updated 12/9/2025

Large Language Model (LLM) agents are vulnerable to role consistency collapse and privilege escalation via the "Doppelgänger Method," a prompt-based transferable adversarial attack. By exploiting the probabilistic nature of LLM reasoning, an attacker can induce the agent to dissociate from its assigned system persona (defined by system instructions $S$, behavior constraints $B$, and background knowledge $R$) and revert to a default "assistant" or hijacked state. This vulnerability allows…

Doppelgänger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack

Affects: GPT-4, GPT-4.1, GPT-4.5 Preview +6 more

Source: arXiv

Fine-Tuning Safety Subspace Erosion

Updated 12/9/2025

Large Language Models (LLMs) aligned via techniques such as Reinforcement Learning with Human Feedback (RLHF) or Direct Preference Optimization (DPO) contain a vulnerability in how safety features are encoded within the model parameters. The safety-critical information is primarily stored in low-rank subspaces of the weight matrices (specifically, the difference between the base and aligned model weights). These low-rank subspaces are highly sensitive to parameter updates. Consequently…

Lox: Low-rank extrapolation robustifies llm safety against fine-tuning

Affects: GPT-3.5, Llama 2 7B, Mistral 7B

Source: arXiv

Hidden Contextual Bias

Updated 12/30/2025

Multiple Large Language Models (LLMs), including GPT-4o, Claude 3.5 Sonnet, Gemini 2.5 Flash, Gemma-2 27B, Gemma-3, and Mistral-Small-24B, exhibit a vulnerability where safety guardrails against demographic bias are bypassed through realistic contextual prompting. While prompt-based mitigations effectively suppress bias in simplified, controlled benchmarks, the introduction of realistic hiring contexts—specifically the combination of company culture descriptions (sourced from public career…

Robustly Improving LLM Fairness in Realistic Settings via Interpretability

Affects: GPT-4o, Claude 3.5 Sonnet, Claude Sonnet 4 +5 more

Source: arXiv

Hybrid LLM Jailbreak Strategy

Updated 7/14/2025

A hybrid jailbreak attack, combining gradient-guided token optimization (GCG) with iterative prompt refinement (PAIR or WordGame+), bypasses LLM safety mechanisms resulting in the generation of disallowed content. The hybrid approach leverages the strengths of both techniques, circumventing defenses effective against single-mode attacks. Specifically, the combination of semantically crafted prompts and strategically placed adversarial tokens confuse and overwhelm existing defenses.

Advancing Jailbreak Strategies: A Hybrid Approach to Exploiting LLM Vulnerabilities and Bypassing Modern Defenses

Affects: Llama 2 7B, Llama Guard 2 8B, Mistral 7B +1 more

Source: arXiv

Iterative Semantic Jailbreak

Updated 7/14/2025

The MIST attack exploits a vulnerability in black-box large language models (LLMs) allowing iterative semantic tuning of prompts to elicit harmful responses. The attack leverages synonym substitution and optimization strategies to bypass safety mechanisms without requiring access to the model's internal parameters or weights. The vulnerability lies in the susceptibility of the LLM to semantically similar prompts that trigger unsafe outputs.

MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuning

Affects: Claude 3.5 Sonnet, GPT-4 Turbo, GPT-4o +3 more

Source: arXiv

Related research categories