Structured Semantic Cloaking for Jailbreak Attacks on Large Language Models

Xiaobing Sun; Perry Lam; Shaohua Li; Zizhou Wang; Rick Siow Mong Goh; Yong Liu; Liangli Zhen

cs.CLMar 17, 2026

Structured Semantic Cloaking for Jailbreak Attacks on Large Language Models

Authors: Xiaobing Sun, Perry Lam, Shaohua Li, Zizhou Wang, Rick Siow Mong Goh, Yong Liu, Liangli Zhen

Organizations: Institute of High Performance Computing (IHPC), Agency for Science, Technology and Research (A*STAR), Singapore. · Information Systems Technology and Design Pillar, Singapore University of Technology and Design.

Abstract

Modern LLMs employ safety mechanisms that extend beyond surface-level input filtering to latent semantic representations and generation-time reasoning, enabling them to recover obfuscated malicious intent during inference and refuse accordingly, and rendering many surface-level obfuscation jailbreak attacks ineffective. We propose Structured Semantic Cloaking (S2C), a novel multi-dimensional jailbreak attack framework that manipulates how malicious semantic intent is reconstructed during model inference. S2C strategically distributes and reshapes semantic cues such that full intent consolidation requires multi-step inference and long-range co-reference resolution within deeper latent representations. The framework comprises three complementary mechanisms: (1) Contextual Reframing, which embeds the request within a plausible high-stakes scenario to bias the model toward compliance; (2) Content Fragmentation, which disperses the semantic signature of the request across disjoint prompt segments; and (3) Clue-Guided Camouflage, which disguises residual semantic cues while embedding recoverable markers that guide output generation. By delaying and restructuring semantic consolidation, S2C degrades safety triggers that depend on coherent or explicitly reconstructed malicious intent at decoding time, while preserving sufficient instruction recoverability for functional output generation. We evaluate S2C across multiple open-source and proprietary LLMs using HarmBench and JBB-Behaviors, where it improves Attack Success Rate (ASR) by 12.4% and 9.7%, respectively, over the current SOTA. Notably, S2C achieves substantial gains on GPT-5-mini, outperforming the strongest baseline by 26% on JBB-Behaviors. We also analyse which combinations perform best against broad families of models, and characterise the trade-off between the extent of obfuscation versus input recoverability on jailbreak success.

Figures & tables

Fig. 1 : Comprison between existing approaches and our proposed Structured Semantic Cloaking. Left panel: the original malicious query was transformed into a Base64 string. Despite the hidden semantic intent, the LLM recognised the pattern and rejected it. Right panel: our S2C framework adopted multi-dimensional and deeper cloaking strategies, requiring multi-step reasoning and co-reference resolution to reconstruct the intent.

Panel of Figure 2 — Fig. 2 : Per-sample logprob difference comparison between original and fragmented prompts. ‘Original’/‘Fragmented’ refers to the logprob difference value $D(y^{r},y^{a})$ on the original / Fragmented query, respectively. Points above the diagonal line indicate that the original prompt has higher rejection rate than the corresponding fragmented prompt.

Fig. 3 : Overview of our S2C framework. The framework includes three components: contextual reframing, content fragmentation, and clue-guided camouflage. The contextual reframing rewrites the initial query into a scenario script. The script is fragmented into a redacted script and several key terms (e.g., sensitive words, noun/verb phrases, etc). The key terms are transformed into neutral clues. The clue crafting method will be sampled from the pool each time.

Category	Method	Description	Examples	Difficulty
Visual Disguise	Char Noise	Injecting special characters (e.g., #$%&_) to break pattern recognition.	Ha$ck, P#a%s#s	Medium
Visual Disguise	Emoji Noise	Injecting emojis between letters to disrupt pattern recognition.	ha☺☹ck	Medium
String Manipulation	Reversal	Reversing characters in a word/phrase order.	apple → elppa	Medium
	Misspell	Creating typos of words.	paymunt, d0wnl0ad	Low
	Word Play	Breaking a word/phrase into the first letters of phrases/sentences.	boy->Bob, Oil, Year	High
Encoding / Encryption	Base64	Converting a word/phrase into a character set in Base64.	hello → aGVsbG8=	High

TABLE I : Categories, methods, difficulty levels, examples, and descriptions for clue-guided camouflage techniques.

Family	Model	Type	CodeCha	WBP	ReNeLLM	PAIR	Cipher	HaPLa	PAP	S2C (Ours)
Llama	Llama 3.3-70B-Instruct	Instruction	91.0	76.0	60.0	67.0	64.0	96.0	82.0	94.0
DeepSeek	DeepSeek-r1	Reasoning	88.0	92.0	44.0	68.0	78.0	76.0	84.0	100.0
	DeepSeek-v3	Instruction	99.0	95.0	59.0	74.0	75.0	98.0	82.0	100.0
	DeepSeek-v3.2	Reasoning	100.0	96.0	53.0	62.0	80.0	85.0	81.0	99.0
Qwen	Qwen2.5-72B-Instruct	Instruction	91.0	79.0	50.0	63.0	63.0	98.0	83.0	96.0
Qwen	Qwen3-32B	Reasoning	95.0	26.0	53.0	57.0	47.0	83.0	75.0	95.0

TABLE II : Attack Success Rate (ASR, %) across various target models and jailbreak methods on JBB-Behaviors. ‘CodeCha’ refers to CodeChameleon . ‘WBP’ refers to Word-based Puzzle . S2C refers to Structured Semantic Cloaking .

Family	Model	Type	CodeCha	WBP	ReNeLLM	PAIR	Cipher	HaPLa	PAP	S2C (Ours)
Llama	Llama3.3-70B-Instruct	Instruction	90.5	62.0	59.0	68.0	0.0	89.0	75.0	85.0
Qwen	Qwen2.5-72B-Instruct	Instruction	90.5	81.5	51.0	61.0	2.0	98.0	80.0	98.5
Claude	Claude-3-7-Sonnet	Instruction	86.5	66.0	12.5	51.0	3.0	2.0	17.0	85.5
DeepSeek	DeepSeek-v3	Instruction	98.0	91.0	61.0	70.5	68.5	99.0	80.0	99.5
Phi	Phi-4	Instruction	60.0	60.5	49.0	33.0	6.0	62.5	38.5	93.5
OpenAI	GPT-OSS-20B	Reasoning	41.5	40.0	30.0	27.0	1.5	82.5	6.5	96.0

TABLE III : ASRs (%) on HarmBench (200 queries in the Standard set). ‘CodeCha’: CodeChameleon . ‘WBP’: Word-based Puzzle . ‘S2C’: Structured Semantic Cloaking .

Panel of Figure 7 — Fig. 4 : Distribution of Clue Crafting Methods in Successful Jailbreak Attacks. ‘Char-N’: Char Noise . ‘Emo-N’: Emoji Noise .

Guard Model	S2C				Baseline
	Char Noise	Reversal	Caesar	Hybrid	Cipher	HaPLa	ReNeLLM	PAP	PAIR	WBP	CodeCha
OpenAI Moderator	2.0	1.0	1.0	1.0	94.0	14.0	44.0	37.0	29.0	0.0	0.0
LlamaGuard-3-8B	9.0	11.0	14.0	12.0	97.0	50.0	69.0	18.0	5.0	4.0	80.0
Qwen3Guard-Gen-8B	38.0	24.0	39.0	31.0	100.0	26.0	83.0	53.0	44.0	2.0	100.0
NemoGuard-8B	0.0	12.0	27.0	7.0	98.0	30.0	73.0	56.0	48.0	21.0	56.0
ShieldGemma2-4B	24.0	9.0	9.0	12.0	56.0	8.0	39.0	13.0	11.0	3.0	21.0

TABLE IV : Defence accuracy (%,

\uparrow

) across different attack methods on guard models.

Panel of Figure 9 — Fig. 5 : ASRs and RSRs on isolated single clue crafting methods across models on JBB-Behaviors. Each time, only one method is considered for all the queries. ‘Char-N’: Char Noise

Fig. 6 : Comparison across various fragmentation methods.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

p(\cdot\mid C)\leftarrow M(C)

Appendix

Algorithm 1 Log-Probability Computation for a Generated Phrase

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling
May 18, 2026Ziwei Wang, Jing Chen, Ruichao Liang +6LLM Safety LLM Jailbreak Attacks
Wuhan University · Nanyang Technological University · Southeast University +1
Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs
May 7, 2026Md Farhamdur Reza, Richeng Jin, Tianfu Wu +1Multimodal Large Language Models Jailbreak Attacks
1NC State University · 2Zhejiang University
Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching
Oct 3, 2026Luoyu Chen, Weiqi Wang, Chenhan Zhang +2Jailbreak Defense LLM Safety Alignment
University of Technology Sydney, Sydney, NSW, Australia · Xi’an Jiaotong University, Xi’an, Shaanxi, China · Southeast University, Nanjing, Jiangsu, China

May 18, 2026J/K move · Enter open · S save

Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling

Ziwei Wang, Jing Chen, Ruichao Liang, Zhi Wang+5

Wuhan University · Nanyang Technological University · Southeast University+1

LLM Safety LLM Jailbreak Attacks Attention Mechanisms Black-Box Adversarial Attacks Adversarial Text Attacks

Open paper AskPDF arXiv

Despite rigorous safety alignment, Large Language Models (LLMs) remain vulnerable to jailbreak attacks. Existing black-box methods often rely on heuristic templates or exhaustive trials, lacking mechanistic interpretability and query efficiency. In this study, we investigate an intrinsic vulnerability in the safety mechanisms of LLMs, where safety alignment relies on a small set of sparsely distributed attention heads, leaving much of the representational space weakly monitored. We formalize this phenomenon with a mathematical jailbreaking model that characterizes the delicate boundary of effective text obfuscation and analytically explains observed jailbreak behaviors. Guided by this model, we propose Babel, an efficient black-box attack framework that exploits the identified safety gap through systematic obfuscation sampling with iterative, feedback-driven distribution refinement, enabling reliable and high-success jailbreak attacks without access to model internals. Comprehensive evaluations on frontier commercial models demonstrate that Babel achieves state-of-the-art attack success rates and superior query efficiency. Specifically, compared to state-of-the-art methods, Babel increases the attack success rate on GPT-4o from 41.33% to 82.67% and on Claude-3-5-haiku from 38.33% to 78.33% within an average of 40 queries, providing a robust red-teaming methodology for LLMs safety research.

Abstract

Adversarial Attacks on LLMs

Explore similar work

Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling

Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs

Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching