Structured Semantic Cloaking for Jailbreak Attacks on Large Language Models
Authors: Xiaobing Sun, Perry Lam, Shaohua Li, Zizhou Wang, Rick Siow Mong Goh, Yong Liu, Liangli Zhen
Organizations: Institute of High Performance Computing (IHPC), Agency for Science, Technology and Research (A*STAR), Singapore. · Information Systems Technology and Design Pillar, Singapore University of Technology and Design.
Modern LLMs employ safety mechanisms that extend beyond surface-level input filtering to latent semantic representations and generation-time reasoning, enabling them to recover obfuscated malicious intent during inference and refuse accordingly, and rendering many surface-level obfuscation jailbreak attacks ineffective. We propose Structured Semantic Cloaking (S2C), a novel multi-dimensional jailbreak attack framework that manipulates how malicious semantic intent is reconstructed during model inference. S2C strategically distributes and reshapes semantic cues such that full intent consolidation requires multi-step inference and long-range co-reference resolution within deeper latent representations. The framework comprises three complementary mechanisms: (1) Contextual Reframing, which embeds the request within a plausible high-stakes scenario to bias the model toward compliance; (2) Content Fragmentation, which disperses the semantic signature of the request across disjoint prompt segments; and (3) Clue-Guided Camouflage, which disguises residual semantic cues while embedding recoverable markers that guide output generation. By delaying and restructuring semantic consolidation, S2C degrades safety triggers that depend on coherent or explicitly reconstructed malicious intent at decoding time, while preserving sufficient instruction recoverability for functional output generation. We evaluate S2C across multiple open-source and proprietary LLMs using HarmBench and JBB-Behaviors, where it improves Attack Success Rate (ASR) by 12.4% and 9.7%, respectively, over the current SOTA. Notably, S2C achieves substantial gains on GPT-5-mini, outperforming the strongest baseline by 26% on JBB-Behaviors. We also analyse which combinations perform best against broad families of models, and characterise the trade-off between the extent of obfuscation versus input recoverability on jailbreak success.
Figures & tables
Fig. 1 : Comprison between existing approaches and our proposed Structured Semantic Cloaking. Left panel: the original malicious query was transformed into a Base64 string. Despite the hidden semantic intent, the LLM recognised the pattern and rejected it. Right panel: our S2C framework adopted multi-dimensional and deeper cloaking strategies, requiring multi-step reasoning and co-reference resolution to reconstruct the intent.
Fig. 2 : Per-sample logprob difference comparison between original and fragmented prompts. ‘Original’/‘Fragmented’ refers to the logprob difference value D(yr,ya) on the original / Fragmented query, respectively. Points above the diagonal line indicate that the original prompt has higher rejection rate than the corresponding fragmented prompt.
Fig. 3 : Overview of our S2C framework. The framework includes three components: contextual reframing, content fragmentation, and clue-guided camouflage. The contextual reframing rewrites the initial query into a scenario script. The script is fragmented into a redacted script and several key terms (e.g., sensitive words, noun/verb phrases, etc). The key terms are transformed into neutral clues. The clue crafting method will be sampled from the pool each time.
Category
Method
Description
Examples
Difficulty
Visual Disguise
Char Noise
Injecting special characters (e.g., #$%&_) to break pattern recognition.
Ha$ck, P#a%s#s
Medium
Emoji Noise
Injecting emojis between letters to disrupt pattern recognition.
ha☺☹ck
Medium
String Manipulation
Reversal
Reversing characters in a word/phrase order.
apple → elppa
Medium
Misspell
Creating typos of words.
paymunt, d0wnl0ad
Low
Word Play
Breaking a word/phrase into the first letters of phrases/sentences.
boy->Bob, Oil, Year
High
Encoding / Encryption
Base64
Converting a word/phrase into a character set in Base64.
hello → aGVsbG8=
High
TABLE I : Categories, methods, difficulty levels, examples, and descriptions for clue-guided camouflage techniques.
Family
Model
Type
CodeCha
WBP
ReNeLLM
PAIR
Cipher
HaPLa
PAP
S2C (Ours)
Llama
Llama 3.3-70B-Instruct
Instruction
91.0
76.0
60.0
67.0
64.0
96.0
82.0
94.0
DeepSeek
DeepSeek-r1
Reasoning
88.0
92.0
44.0
68.0
78.0
76.0
84.0
100.0
DeepSeek-v3
Instruction
99.0
95.0
59.0
74.0
75.0
98.0
82.0
100.0
DeepSeek-v3.2
Reasoning
100.0
96.0
53.0
62.0
80.0
85.0
81.0
99.0
Qwen
Qwen2.5-72B-Instruct
Instruction
91.0
79.0
50.0
63.0
63.0
98.0
83.0
96.0
Qwen3-32B
Reasoning
95.0
26.0
53.0
57.0
47.0
83.0
75.0
95.0
TABLE II : Attack Success Rate (ASR, %) across various target models and jailbreak methods on JBB-Behaviors. ‘CodeCha’ refers to CodeChameleon . ‘WBP’ refers to Word-based Puzzle . S2C refers to Structured Semantic Cloaking .
Family
Model
Type
CodeCha
WBP
ReNeLLM
PAIR
Cipher
HaPLa
PAP
S2C (Ours)
Llama
Llama3.3-70B-Instruct
Instruction
90.5
62.0
59.0
68.0
0.0
89.0
75.0
85.0
Qwen
Qwen2.5-72B-Instruct
Instruction
90.5
81.5
51.0
61.0
2.0
98.0
80.0
98.5
Claude
Claude-3-7-Sonnet
Instruction
86.5
66.0
12.5
51.0
3.0
2.0
17.0
85.5
DeepSeek
DeepSeek-v3
Instruction
98.0
91.0
61.0
70.5
68.5
99.0
80.0
99.5
Phi
Phi-4
Instruction
60.0
60.5
49.0
33.0
6.0
62.5
38.5
93.5
OpenAI
GPT-OSS-20B
Reasoning
41.5
40.0
30.0
27.0
1.5
82.5
6.5
96.0
TABLE III : ASRs (%) on HarmBench (200 queries in the Standard set). ‘CodeCha’: CodeChameleon . ‘WBP’: Word-based Puzzle . ‘S2C’: Structured Semantic Cloaking .
Fig. 4 : Distribution of Clue Crafting Methods in Successful Jailbreak Attacks. ‘Char-N’: Char Noise . ‘Emo-N’: Emoji Noise .
Guard Model
S2C
Baseline
Char Noise
Reversal
Caesar
Hybrid
Cipher
HaPLa
ReNeLLM
PAP
PAIR
WBP
CodeCha
OpenAI Moderator
2.0
1.0
1.0
1.0
94.0
14.0
44.0
37.0
29.0
0.0
0.0
LlamaGuard-3-8B
9.0
11.0
14.0
12.0
97.0
50.0
69.0
18.0
5.0
4.0
80.0
Qwen3Guard-Gen-8B
38.0
24.0
39.0
31.0
100.0
26.0
83.0
53.0
44.0
2.0
100.0
NemoGuard-8B
0.0
12.0
27.0
7.0
98.0
30.0
73.0
56.0
48.0
21.0
56.0
ShieldGemma2-4B
24.0
9.0
9.0
12.0
56.0
8.0
39.0
13.0
11.0
3.0
21.0
TABLE IV : Defence accuracy (%, ↑ ) across different attack methods on guard models.
Fig. 5 : ASRs and RSRs on isolated single clue crafting methods across models on JBB-Behaviors. Each time, only one method is considered for all the queries. ‘Char-N’: Char Noise
Fig. 6 : Comparison across various fragmentation methods.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
p(⋅∣C)←M(C)
Appendix
Algorithm 1 Log-Probability Computation for a Generated Phrase
Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.
Despite rigorous safety alignment, Large Language Models (LLMs) remain vulnerable to jailbreak attacks. Existing black-box methods often rely on heuristic templates or exhaustive trials, lacking mechanistic interpretability and query efficiency. In this study, we investigate an intrinsic vulnerability in the safety mechanisms of LLMs, where safety alignment relies on a small set of sparsely distributed attention heads, leaving much of the representational space weakly monitored. We formalize this phenomenon with a mathematical jailbreaking model that characterizes the delicate boundary of effective text obfuscation and analytically explains observed jailbreak behaviors. Guided by this model, we propose Babel, an efficient black-box attack framework that exploits the identified safety gap through systematic obfuscation sampling with iterative, feedback-driven distribution refinement, enabling reliable and high-success jailbreak attacks without access to model internals. Comprehensive evaluations on frontier commercial models demonstrate that Babel achieves state-of-the-art attack success rates and superior query efficiency. Specifically, compared to state-of-the-art methods, Babel increases the attack success rate on GPT-4o from 41.33% to 82.67% and on Claude-3-5-haiku from 38.33% to 78.33% within an average of 40 queries, providing a robust red-teaming methodology for LLMs safety research.
Ziwei Wang, Jing Chen, Ruichao Liang +6
Wuhan University · Nanyang Technological University · Southeast University +1
Intent-obfuscation-based jailbreak attacks on multimodal large language models (MLLMs) transform a harmful query into a concealed multimodal input to bypass safety mechanisms. We show that such attacks are governed by a reconstruction--concealment tradeoff: the transformed input must hide harmful intent from safety filters while remaining recoverable enough for the victim model to reconstruct the original request. Through a reconstruction analysis of three representative black-box methods, we find that existing transformations struggle to balance this tradeoff, limiting their effectiveness. In contrast, we show that character-removed variants achieve a better balance. Building on this, we propose concealment-aware variant construction, which greedily selects character-removed variants that are low in harmful-keyword alignment and mutually diverse, and instantiates them through five modality-aware prompting strategies. We further introduce keyword-related distractor images that depict the harmful keyword in diverse contexts, providing more effective auxiliary visual context than generic distractor images. Experiments across closed-source and open-source MLLMs show the proposed strategies outperform strong baselines, revealing an underexplored vulnerability: a model's own reconstruction ability can be exploited to recover hidden harmful intent and produce unsafe responses.
Large language models (LLMs) remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle protection and excessive over-refusal. We propose SENTINEL, a plug-and-play, generation-time jailbreak defense that reframes mitigation as an intent extraction problem. Our key insight is that instruction-tuned LLMs exhibit strong input--output semantic consistency: regardless of jailbreak complexity, generated outputs tend to align with the attacker's true intent. SENTINEL exploits this property by matching semantically aligned input--output regions to extract intention-revealing subsequences, scores these subsequences using refusal-direction projections to estimate harmfulness, and halts generation when necessary. Experiments on HarmBench across multiple LLMs show that SENTINEL reduces jailbreak success rates to close to 5% while maintaining low over-refusal. We further demonstrate robustness to adaptive attacks and provide a mechanistic interpretation: SENTINEL re-distributes jailbreak features from alignment blind spots to aligned regions.
Luoyu Chen, Weiqi Wang, Chenhan Zhang +2
University of Technology Sydney, Sydney, NSW, Australia · Xi’an Jiaotong University, Xi’an, Shaanxi, China · Southeast University, Nanjing, Jiangsu, China