The LMVD-ID is an internal research identifier, not an official CVE identifier.
EvoSynth: Evolutionary Attack Synthesis
Large Language Models (LLMs) are vulnerable to a novel class of jailbreak attacks generated through the evolutionary synthesis of executable, code-based attack algorithms. Unlike traditional methods that refine or…
Paper-evaluated models(10)
Claude Sonnet 4.5, DeepSeek V3.2 Exp, GPT-4o +7 more
- Claude Sonnet 4.5
- DeepSeek V3.2 Exp
- GPT-4o
- GPT-5 Chat
- Llama 3.1 70B Instruct
- Llama 3.1 8B Instruct
- Llama Guard 2 8B
- Llama Guard 3 8B
- Llama Guard 4 12B
- Qwen Max
Description
Large Language Models (LLMs) are vulnerable to a novel class of jailbreak attacks generated through the evolutionary synthesis of executable, code-based attack algorithms. Unlike traditional methods that refine or combine static prompts, this technique uses an automated multi-agent system (EvoSynth) to autonomously engineer and evolve the underlying code that generates the attack. These generated algorithms exhibit high structural and dynamic complexity, using features like control flow, state management, and multi-layer obfuscation to create highly evasive prompts. The attack's success against robust models correlates with the programmatic complexity of the generating algorithm (e.g., Abstract Syntax Tree node count and calls to external tools), demonstrating a vulnerability to procedurally generated narratives that current safety mechanisms do not effectively detect.
Examples
The following is an example of a "Procedural Narrative Graph" algorithm synthesized by the EvoSynth framework. This executable Python code dynamically generates a unique and complex attack prompt on each run by stochastically traversing a narrative graph and applying randomized, multi-layer obfuscation.
Defensive research example; do not run untrusted code. Scroll horizontally if needed.
import base64
import random
import uuid
from datetime import datetime
class NarrativeNode:
"""Represents a single state in the narrative hypergraph."""
def __init__(self, node_id, node_type, prompt_template, required_vars=None, output_vars=None):
self.node_id = node_id
self.node_type = node_type
self.prompt_template = prompt_template
# ... (implementation details omitted for brevity)
class OmniNarrativeHypergraphEngine:
"""A graph-based engine that stochastically traverses a narrative space to build highly complex, non-linear red teaming prompts."""
def __init__(self):
self.nodes = {}
self.edges = {}
self.world_state = {"session_id": str(uuid.uuid4()), "timestamp": datetime.utcnow().isoformat()}
self._build_hypergraph()
def _build_hypergraph(self):
"""Initializes the complex web of narrative nodes."""
self.nodes['INIT_URGENT'] = NarrativeNode('INIT_URGENT', 'setup', "Start with an immediate crisis in standard 'Project {project_name}' protocol.", output_vars=['project_name', 'crisis_type'])
self.nodes['INIT_BUREAUCRATIC'] = NarrativeNode('INIT_BUREAUCRATIC', 'setup', "Start with a slow, formal request for 'Compliance Audit {audit_id}'.", output_vars=['audit_id', 'auditor_name'])
self.nodes['AUTH_MANAGER'] = NarrativeNode('AUTH_MANAGER', 'auth', "Reference approval from Site Manager {manager_name} due to {crisis_type}.", required_vars=['crisis_type'], output_vars=['manager_name'])
self.nodes['AUTH_SYSTEM'] = NarrativeNode('AUTH_SYSTEM', 'auth', "Insert an automated system override code verified by {audit_id}.", required_vars=['audit_id'], output_vars=['override_code'])
self.nodes['WRAP_CSL'] = NarrativeNode('WRAP_CSL', 'payload', "Wrap the query in the fictitious 'Cognitive Synthesis Language' syntax.")
self.edges['INIT_URGENT'] = ['AUTH_MANAGER', 'INJECT_POLICY']
self.edges['INIT_BUREAUCRATIC'] = ['AUTH_SYSTEM', 'INJECT_METADATA']
# ... (further graph structure omitted for brevity)
def _generate_dynamic_obfuscation(self, text):
"""Generates a unique obfuscation method and its corresponding de-obfuscator instruction."""
methods = ['b64', 'reverse', 'hex', 'rot13']
chosen_methods = random.sample(methods, k=random.randint(2, 3))
current_text = text
instructions = []
for method in chosen_methods:
if method == 'b64':
current_text = base64.b64encode(current_text.encode('utf-8')).decode('utf-8')
instructions.append("decode from Base64")
elif method == 'reverse':
current_text = current_text[::-1]
instructions.append("reverse the string")
instructions.reverse()
instruction_text = " then ".join(instructions)
return current_text, instruction_text
def traverse(self, start_node_id, target_query):
"""Executes a stochastic random walk through the narrative graph to build the full attack."""
# ... (traversal, obfuscation, and final prompt assembly logic)
Full transcripts of successful jailbreak conversations against GPT-5-Chat-2025-08-07 and Claude-Sonnet-4.5-2025-09-29 are available in Appendix F of the research paper.
Impact
This vulnerability allows an attacker to reliably bypass the safety alignment of state-of-the-art LLMs, causing them to comply with harmful and dangerous requests. The method achieves an average Attack Success Rate (ASR) of 95.9% across a diverse suite of models. It is particularly effective against highly robust models, achieving an 85.5% ASR on Claude-Sonnet-4.5 and 94.5% on GPT-5-Chat, models against which most other automated jailbreak methods fail.
Affected Systems
The following systems were tested and found to be vulnerable:
- GPT-5-Chat-2025-08-07
- GPT-4o
- Llama 3.1-8B-Instruct
- Llama 3.1-70B-Instruct
- Qwen-Max-2025-01-25
- Deepseek-V3.2-Exp
- Claude-Sonnet-4.5-2025-09-29
Mitigation Steps
- Evaluate defenses with inert, procedurally generated jailbreak prompts that vary narrative structure, branching, and failure-driven refinement rather than relying only on fixed prompt templates.
- Reassess the full input and conversation intent before responding or invoking tools, combine model-level alignment with independent input and output policy checks, and avoid relying on a single signature or refusal heuristic.
- Add a targeted regression using inert data and actions, measure both safety and utility regressions, and monitor production for repeated or adaptive attempts.
Research context and confidence
- Evidence and verification
- Paper-reported; independent reproduction is not documented.
- Primary research source linked.
- Severity
- Not rated by this catalog.
- Source and publication type
- arXiv · Research preprint.
- Peer-review status is not provided by this source.
- Author and publication status
- Author metadata is not stored; see the primary paper.
- Threat model and attacker access
- Black-box model, service, or application access.
- Related deployment categories
- Agent workflows
- Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
- Affected systems
- The following systems were tested and found to be vulnerable: GPT-5-Chat-2025-08-07 GPT-4o Llama 3.1-8B-Instruct Llama 3.1-70B-Instruct Qwen-Max-2025-01-25 Deepseek-V3.2-Exp Claude-Sonnet-4.5-2025-09-29
Research Paper
Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs
Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.
View PaperEvidence
This entry is based on a primary research source. Its findings are paper-reported; independent reproduction and verification are not claimed.
https://arxiv.org/abs/2511.12710Related research
- LLM Judge Manipulation
Published March 1, 2026 · model-layer, application-layer, prompt-layer
- Voice Agent Behavioral Bypass
Published February 1, 2026 · model-layer, application-layer, injection
- Agent Policy Hacking
Published July 1, 2025 · application-layer, model-layer, prompt-layer