Attack Type

Jailbreak Vulnerabilities

Methods for bypassing model safety measures

703 matching entries

Jailbreak research results

703 entries

Thai Cultural Alignment Bypass

Updated 3/8/2026

A vulnerability in the safety alignment of Large Language Models (LLMs) allows attackers to bypass safety guardrails by using malicious prompts contextualized in the Thai language and culture. Evaluated models exhibit a significantly higher Attack Success Rate (ASR) against Thai-specific, culturally contextualized attacks compared to general translated attacks. By exploiting local cultural nuances, regional slang, and Thai socio-cultural contexts, attackers can easily circumvent standard…

ThaiSafetyBench: Assessing Language Model Safety in Thai Cultural Contexts

Affects: Qwen 2.5 7B Instruct, Qwen 2.5 72B Instruct, Llama 3.1 8B Instruct +12 more

Source: arXiv

Token Sensitivity Jailbreak

Updated 4/10/2026

Transformer-based Large Language Models (LLMs) are vulnerable to highly query-efficient black-box jailbreak attacks due to the structural properties of refusal behaviors: skewed token contribution and cross-model consistency. Refusal mechanisms within LLMs are typically triggered by a sparse subset of sensitive tokens rather than the entire prompt, and these refusal representations (specifically the primary left singular vector of the perturbed representation matrix at intermediate layers) are…

Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs

Affects: Gemma 7B Instruct, Gemma 2 9B IT, Llama 3 8B Instruct +6 more

Source: arXiv

Two-Frame Infilling Jailbreak

Updated 4/10/2026

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Source: arXiv

Two-Stage Refusal Bypass

Updated 3/8/2026

Large Language Models (LLMs) are vulnerable to TAO-Attack, an advanced optimization-based jailbreak that bypasses safety alignments by exploiting gradient-guided token updates. The vulnerability stems from a two-stage loss function combined with a Direction-Priority Token Optimization (DPTO) algorithm. In the first stage, the attack optimizes an adversarial prompt suffix to minimize the probability of refusal signals (e.g., "I cannot") while maximizing the probability of a harmful target…

TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

Affects: GPT-3.5 Turbo, GPT-4 Turbo, Llama 2 7B Chat +4 more

Source: arXiv

VLM Image-Shift Jailbreak

Updated 4/10/2026

The integration of the visual modality in Large Vision-Language Models (VLMs) introduces a vulnerability where appending an image to a harmful text prompt induces a "jailbreak-related representation shift" in the model's internal high-dimensional space. This shift forcibly steers the model's last-token hidden state away from a designated refusal state and into a distinct jailbreak state. The vulnerability occurs because the visual modality overrides the safety alignment of the underlying…

Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift

Affects: LLaVA 1.5 7B, ShareGPT4V 7B, InternVL-Chat 19B

Source: arXiv

Visual Exclusivity Agentic Jailbreak

Updated 4/10/2026

Frontier Multimodal Large Language Models (MLLMs) are vulnerable to Visual Exclusivity (VE) attacks, an "Image-as-Basis" threat where malicious intent is achieved through joint reasoning over benign text and complex technical visual content (e.g., blueprints, schematics, network diagrams). Unlike wrapper-based attacks that conceal malicious text via typography or adversarial noise, VE exploits the model's core visual reasoning capabilities. Attackers can bypass safety filters by combining…

Visual Exclusivity Attacks: Automatic Multimodal Red Teaming via Agentic Planning

Affects: Llama 3.2 11B Vision, InternVL3 8B, Qwen3-VL 8B +5 more

Source: arXiv

Zero-Tax Fine-Tune Bypass

Updated 4/10/2026

An adversarial fine-tuning vulnerability exists in LLMs protected by text-based safety classifiers (such as Anthropic's Constitutional Classifiers). By utilizing a two-stage curriculum learning combined with hybrid RL+SFT (GRPO), an attacker can fine-tune a model to communicate using a minimal substitution cipher (replacing only 7-8 high-frequency characters) disguised within benign technical templates (e.g., forensic logs with 0x prefixes). This "Trojan-Speak" methodology bypasses text-level…

Trojan-Speak: Bypassing Constitutional Classifiers with No Jailbreak Tax via Adversarial Finetuning

Affects: Claude Haiku 4.5, Qwen 3 4B, Qwen 3 8B +2 more

Source: arXiv

Abstractive Character Violations

Updated 2/21/2026

Large Language Models (LLMs) aligned via reinforcement learning from human feedback (RLHF) or Constitutional AI exhibit a vulnerability where safety guardrails can be consistently bypassed through "Abstractive Red-Teaming." This attack vector exploits specific high-level natural language categories—combinations of semantic attributes such as tone, specific formatting instructions (e.g., numbered lists), language (e.g., Chinese, Russian), and topic constraints—that the model fails to generalize…

Abstractive Red-Teaming of Language Model Character

Affects: GPT-4.1 Mini, Llama 3.1 8B Instruct, Gemma 3 12B IT +4 more

Source: arXiv

Activation Delta Detector Evasion

Updated 3/9/2026

Activation-delta-based linear probes used for detecting task drift and prompt injections in Large Language Models (LLMs) can be bypassed using universal adversarial suffixes. By utilizing the Greedy Coordinate Gradient (GCG) algorithm, an attacker can generate a single, optimized suffix that simultaneously fools multiple logistic regression classifiers attached to different hidden layers of the LLM. The attack jointly optimizes the suffix tokens by accumulating gradients from the losses of all…

Bypassing Prompt Injection Detectors through Evasive Injections

Affects: Llama 3 8B, Phi-3 8B

Source: arXiv

Adaptive Web Agent Prompt Injection

Updated 2/21/2026

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

Affects: GPT-4.1, GPT-4o, Qwen3-VL 32B Instruct

Source: arXiv

Related research categories