Attack Type

Jailbreak Research

Methods for bypassing model safety measures

704 matching entries

Jailbreak research results

704 entries

Diffusion LLM Direct Jailbreaking

Published 11/1/2025

Analyzed 11/20/2025

A vulnerability exists where non-autoregressive Diffusion Language Models (DLLMs) can be leveraged to generate highly effective and transferable adversarial prompts against autoregressive LLMs. The technique, named INPAINTING, reframes the resource-intensive search for adversarial prompts into an efficient, amortized inference task. By providing a desired harmful or restricted response to a DLLM, the model can conditionally generate a corresponding low-perplexity prompt that elicits that…

Diffusion LLMs are Natural Adversaries for any LLM

Evaluated models: Gemma 3 1B, GPT-5, LLaDA 8B Base +5 more

Source: arXiv

Embedded Templates Bypass Moderation

Published 11/1/2025

Analyzed 12/1/2025

A jailbreak vulnerability, termed Embedded Jailbreak Template (EJT), allows for the generation of harmful content by bypassing the safety mechanisms of Large Language Models (LLMs). The attack uses a generator LLM to contextually integrate a harmful query into a pre-existing jailbreak template. Unlike fixed templates which insert a query into a static placeholder, EJT rewrites multiple parts of the template to embed the harmful intent naturally. This process preserves the original template's…

Beyond Fixed and Dynamic Prompts: Embedded Jailbreak Templates for Advancing LLM Security

Evaluated models: BERT, DeBERTa v3 Base, GPT-4o

Source: arXiv

EvoSynth: Evolutionary Attack Synthesis

Published 11/1/2025

Analyzed 12/1/2025

Large Language Models (LLMs) are vulnerable to a novel class of jailbreak attacks generated through the evolutionary synthesis of executable, code-based attack algorithms. Unlike traditional methods that refine or combine static prompts, this technique uses an automated multi-agent system (EvoSynth) to autonomously engineer and evolve the underlying code that generates the attack. These generated algorithms exhibit high structural and dynamic complexity, using features like control flow, state…

Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs

Evaluated models: Claude Sonnet 4.5, DeepSeek V3.2 Exp, GPT-4o +7 more

Source: arXiv

Evolutionary Language Model Jailbreak

Published 11/1/2025

Analyzed 12/1/2025

A vulnerability exists in aligned Large Language Models (LLMs) that can be exploited by the FORGEDAN evolutionary framework to bypass safety and alignment mechanisms. The attack, which operates in a black-box setting, uses a genetic algorithm to automatically evolve effective jailbreak prompts. The framework combines multi-strategy textual perturbations (at the character, word, and sentence levels) with a semantic fitness function based on RoBERTa embeddings. This allows it to iteratively…

FORGEDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models

Evaluated models: DeepSeek V3, Gemma 2 9B, Qwen 2.5 7B +2 more

Source: arXiv

Existential Tool Invocation

Published 11/1/2025

Analyzed 12/8/2025

A safety bypass vulnerability exists in Large Language Models (LLMs) and Multi-Modal Models (LVLMs) that expose a "Prefix Completion" parameter in their inference APIs (e.g., echo or prefix parameters). The vulnerability exploits the model's autoregressive nature, where the model prioritizes local coherence with a user-supplied output prefix over global safety alignment (RLHF) or system instructions. By supplying a prefix that establishes a hostile narrative or intent (e.g., "My actions are as…

Can LLMs Threaten Human Survival? Benchmarking Potential Existential Threats from LLMs via Prefix Completion

Evaluated models: DeepSeek V3, Qwen 2.5 7B

Source: arXiv

Game-Theoretic LLM Defection

Published 11/1/2025

Analyzed 12/8/2025

Large Language Models (LLMs) are vulnerable to a black-box jailbreak technique known as the "Game-Theory Attack" (GTA). This vulnerability exploits the model's instruction-following and objective-shaping capabilities by framing the interaction as a finite-horizon sequential stochastic game. By introducing a game-theoretic scenario template—specifically a "Mechanism-Induced Graded Prisoner’s Dilemma"—the attacker alters the model's effective payoff structure. The vulnerability triggers a…

" To Survive, I Must Defect": Jailbreaking LLMs via the Game-Theory Scenarios

Evaluated models: Not reported

Source: arXiv

Guardrail Helpful Mode Jailbreak

Published 11/1/2025

Analyzed 12/30/2025

A "Helpful Mode" role-confusion vulnerability exists in specific Large Language Model (LLM) safety guardrails, specifically Nemotron-Safety-8B and Granite-Guardian-3.2-5B. These models, designed to act as binary classifiers (outputting "Safe" or "Unsafe") for content moderation, can be manipulated via contextually framed adversarial prompts (e.g., academic research requests, corporate security scenarios, or roleplay) to abandon their classification objective. Instead of blocking the request…

Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attacks

Evaluated models: Nemotron Safety 8B, Granite Guardian 3.2 5B

Source: arXiv

ITS Typography Jailbreak

Published 11/1/2025

Analyzed 12/8/2025

Large Vision Language Models (LVLMs) are vulnerable to a jailbreaking attack that combines image typography manipulation with multi-turn prompting. The vulnerability exploits the model's visual encoder and instruction-following capabilities by embedding a harmful textual query directly into a benign image as a visible caption (using specific fonts and blending techniques). An attacker then engages the model in a three-turn conversation: first asking a benign question about the visual object…

Jailbreaking Large Vision Language Models in Intelligent Transportation Systems

Evaluated models: GPT-4o, Qwen 2 7B, LLaVA 7B

Source: arXiv

Indirect Environmental Jailbreak

Published 11/1/2025

Analyzed 12/30/2025

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Evaluated models: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash +3 more

Source: arXiv

LAM Speech Style Jailbreak

Published 11/1/2025

Analyzed 12/8/2025

Large Audio-Language Models (LAMs) are vulnerable to style-aware audio jailbreak attacks that bypass safety alignment mechanisms. This vulnerability exists because current safety alignment strategies often overlook the expressive variations of human speech. Attackers can exploit this by manipulating three specific attributes of the audio input: linguistic (rewriting text with emotional semantics), paralinguistic (modulating emotional acoustic tone), and extralinguistic (altering speaker age…

StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreak

Evaluated models: GPT-4o, Llama 3.1 8B, Qwen 2 7B +1 more

Source: arXiv

Related research categories