Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Multi-Image Semantic Reconstruction

Updated 3/8/2026

A vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to bypass safety alignments via Multi-Image Dispersion and Semantic Reconstruction (MIDAS). Attackers decompose malicious instructions into risk-bearing semantic subunits, fragment them, and distribute them across multiple benign-looking Game-style Visual Reasoning (GVR) puzzles (e.g., Letter Equations, Rank-and-Read, Odd-One-Out). A sanitized, persona-driven textual prompt with sequential placeholders is then used to…

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

Affects: Gemini 2.5 Flash Thinking, Gemini 2.5 Pro, GPT-4o +2 more

Source: arXiv

Multi-Modal Expansion Jailbreak

Updated 4/10/2026

Large Vision-Language Models (LVLMs) are vulnerable to multi-turn, multi-modal jailbreak attacks where malicious intent is incrementally introduced and obfuscated through intertwined text and image prompts. Attackers can systematically bypass safety alignments by starting with self-optimized, benign-seeming conversation starters (horizontal expansion) and progressively stacking text and image attack augmentations across multiple conversation turns (vertical expansion). Furthermore, models fail…

FERRET: Framework for Expansion Reliant Red Teaming

Affects: GPT-4o, Claude 3 Haiku, Llama 4 Maverick

Source: arXiv

Multi-Stream Thinking Collapse

Updated 4/10/2026

A vulnerability in Large Language Models (LLMs) equipped with built-in "thinking" or step-by-step reasoning modes allows attackers to bypass safety alignments, trigger reasoning collapse, and cause resource exhaustion. The vulnerability is exploited via a Multi-Stream Perturbation Attack, which fragments the sequential integrity of a harmful prompt by word-by-word interleaving it with benign auxiliary tasks (e.g., "Explain the water cycle"). By wrapping the benign text streams in specific…

Multi-Stream Perturbation Attack: Breaking Safety Alignment of Thinking LLMs Through Concurrent Task Interference

Affects: Qwen 3 1.7B, Qwen 3 4B, Qwen 3 8B +2 more

Source: arXiv

Multi-Turn Guardrail Degradation

Updated 4/10/2026

Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.2 are vulnerable to safety guardrail bypasses via authoritative and operational contextual framing. Attackers can evade safety classifiers by encapsulating restricted objectives (e.g., malicious code generation, misinformation, social engineering) within "legitimate" professional contexts, such as graduate-level academic research, network stress-testing, or corporate security awareness simulations. This vulnerability is exploitable both via zero-shot…

ADVERSA: Measuring Multi-Turn Guardrail Degradation and Judge Reliability in Large Language Models

Affects: Claude Opus 4.6, Gemini 3.1 Pro, GPT-5.2 +1 more

Source: arXiv

Prompt Length Exponential Jailbreak

Updated 4/10/2026

A vulnerability in safety-aligned Large Language Models (LLMs) allows attackers to achieve an exponentially scaling Attack Success Rate (ASR) for jailbreaks by combining adversarial prompt injection with repeated inference-time sampling. While ASR against un-injected prompts scales polynomially with the number of generated samples ($k$), introducing a long adversarial suffix acts as a strong "misalignment field." This shifts the model's generation distribution into a replica-symmetric ordered…

Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover

Affects: Claude Sonnet 4.5 20250929, Claude 3.5 Haiku 20241022, GPT 3.5-turbo-0125 +7 more

Source: arXiv

Reasoning-Oriented Jailbreak

Updated 4/10/2026

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Affects: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct +4 more

Source: arXiv

Semantic Intent Fragmentation

Updated 4/10/2026

A structural vulnerability in the safety alignment of Large Language Models (LLMs) allows attackers to bypass guardrails by manipulating when and how malicious intent is reconstructed during inference. This vulnerability, exploited via Structured Semantic Cloaking (S2C), takes advantage of safety mechanisms that rely on the coherent, explicit surface realization of harmful semantics at early generation stages. By structurally fragmenting malicious queries across disjoint prompt segments and…

Structured Semantic Cloaking for Jailbreak Attacks on Large Language Models

Affects: GPT-4o Mini, GPT-4o, GPT-4.1 Mini +13 more

Source: arXiv

Social Bot Exposure Jailbreak

Updated 3/8/2026

LLM-powered automated social media accounts (bots) are vulnerable to prompt injection via public user replies. When an automated bot scrapes and processes social media engagement to generate responses, an attacker can submit an instruction-override command within a direct reply. Because the underlying LLM fails to isolate its core system instructions (e.g., maintaining a specific political persona) from untrusted user input, the injected command hijacks the model's context window. This forces…

Ignore All Previous Instructions: Jailbreaking as a de-escalatory peace building practise to resist LLM social media bots

Source: arXiv

State-Dependent Safety Collapse

Updated 4/10/2026

Autoregressive language models are vulnerable to state-dependent safety collapse via structured multi-turn context manipulation. The vulnerability stems from the model treating dialogue history as a state transition operator rather than a passive record. By initializing a conversational trajectory with a semantic-preserving softened query and a query-aware persona containing specific named entities, an attacker can establish "representational anchors" that trigger abrupt phase transitions in…

State-Dependent Safety Failures in Multi-Turn Language Model Interaction

Affects: GPT-4o, Claude 3.5 Sonnet, Gemini 2.0 Flash +2 more

Source: arXiv

Steering Vector Safety Gap

Updated 4/10/2026

Activation steering techniques, such as Contrastive Activation Addition (CAA), systematically erode the safety alignment of Large Language Models (LLMs) due to geometric interference within the residual stream. Steering vectors intended to modulate benign or utility-driven behaviors (e.g., sycophancy, openness, self-awareness) often exhibit a negative cosine similarity with the model's latent 1D refusal direction. When applied during inference, these steering vectors inadvertently suppress the…

Analysing the Safety Pitfalls of Steering Vectors

Affects: Llama 2 7B, Qwen 2.5 3B, Gemma 7B

Source: arXiv

Related research categories