Jailbreak Attacks

Follow this topic Ask about this topic

Jailbreak attacks study how to make AI systems produce harmful or otherwise restricted outputs despite safety safeguards, using methods such as adversarial prompt optimization, encoded instructions, multi-turn persuasion, and search over attack strategies. Research now tests these methods not only on text-only language models but also on image, audio, and video systems, tool-using agents, and robots, with benchmarks including AdvBench, HarmBench, and JailbreakBench. Defenses include input classifiers, tracking intent across turns or tools, and interventions in model activations, but they must preserve useful responses to benign requests. A central challenge is that measured success depends on attack budgets, prompt variants, and evaluation judges, while defenses may fail when harmful intent is disguised by style, language, modality, or context.

Latest papers

76 papers11 papers in the last four weeks, up 57% on the four weeks before. 0.1% of all new papers.

Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak
Oct 28, 2026Xu Zhang, Ziqing Hu, Shuo Han +1Jailbreak Attacks Multimodal Jailbreak Attacks
Illinois Institute of Technology, Chicago, IL, USA · Perplexity AI · University of Illinois Chicago, Chicago, IL, USA
SEMA-Auto: Sighted and Efficient Multi-Turn Attack with Autonomy
Oct 26, 2026Mingqian Feng, Xiaodong Liu, Weiwei Yang +8Adversarial Attacks on LLMs Jailbreak Attacks
University of Rochester · Microsoft Research · Microsoft Azure
Global Security Blind Spots: Translation as a Safety Bypass in Low-Resource Languages
Oct 19, 2026Jalil Alva, David Harper, Abigail E. Thornton +8LLM Safety Language Model Safety Evaluation
Welo Data
Beyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM Jailbreaks
Oct 19, 2026Rohan Menon, Chih-Hong ChengJailbreak Attack Evaluation Jailbreak Attacks
Carl von Ossietzky University of Oldenburg, Oldenburg, Germany · Chalmers University of Technology, Gothenburg, Sweden
Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents
Oct 17, 2026Juanyang Xu, Zheng Wang, Xingyu Zhao +2Adversarial Attacks on LLMs Jailbreak Attacks
University of Macau · WMG, University of Warwick · Wuhan University
RedDarwin: Evolving Jailbreak Skills against Frontier LLMs
Oct 14, 2026Zhouyuan Ma, Yutao Wu, Hanxun Huang +3LLM Jailbreak Attacks LLM Red Teaming
Fudan University · Deakin University · University of Melbourne +2
PatchBench: Measuring Collateral Damage in Activation Patching
Oct 7, 2026Alexi Canesse, Mathis Le Bail, Maël Jenny +3Jailbreak Attack Evaluation Language Model Safety Evaluation
LIX (École Polytechnique, IP Paris, CNRS), France · AMIAD (Agence Ministérielle pour l’IA de Défense), France
From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents
Oct 7, 2026Juanyang Xu, Zheng Wang, Xingyu Zhao +2Jailbreak Attacks LLM Jailbreak Attacks
University of Macau · WMG, University of Warwick · Wuhan University
Where Does the Audio Jailbreak Live? A Controlled Frequency-Depth Audit of AdvWave-P on Qwen2-Audio
Oct 4, 2026Boyuan Chen, Minseok Kim, Sohaila Abdulsattar +4Jailbreak Attacks Adversarial Perturbations
eBRAIN Lab, Division of Engineering, New York University Abu Dhabi, UAE · Tandon School of Engineering, New York University, NY, USA
MLCommons Jailbreak Benchmark v1.0
Oct 2, 2026Carsten Maple, Cagatay Yucel, Isaac Holeman +35Jailbreak Attack Evaluation LLM Safety Benchmarks
Victor · MLCommons · University of Warwick +18
Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks
Oct 1, 2026Fengwei Tian, Ravi TandonJailbreak Attacks LLM Security
School of Electrical, Computing and Software Engineering, University of Arizona, Tucson, AZ 85721, USA.
CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion
Sep 30, 2026Zhen Liang, Hai Huang, Wentao ChenAdversarial Attacks on LLMs Jailbreak Attacks
School of Computer Science and Technology, Zhejiang Sci-Tech University · Zhejiang Key Laboratory of Digital Fashion and Data Governance, Zhejiang Sci-Tech University · China Academy of Information and Communications Technology
SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs
Sep 30, 2026Wenyu Chen, Li Wang, Chuanchao Zang +5VLM Robustness Jailbreak Attacks
Shandong University
Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking
Sep 26, 2026Marco BiroliJailbreak Attacks LLM Jailbreak Attacks
Physical Science Division Chicago, IL 60637, USA
TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks
Sep 25, 2026Tianmeng Fang, Jiancheng Wang, Chen Wang +4Jailbreak Attacks Multimodal Jailbreak Attacks
School of Computing and Information Systems, Master of IT in Business (MITB), Singapore Management University, Singapore 178903, Singapore · School of Computer Science and Technology, Anhui University, Hefei 230601, China · Department of Electrical and Computer Engineering, University of Miami, Coral Gables, FL 33146, United States +3
Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
Sep 9, 2026Thomas RivasseauAdversarial Attacks on LLMs Jailbreak Attacks
School of Information Studies McGill University
DuplexJail: Spoken Interruption Attacks on Full-Duplex Speech Models
Sep 8, 2026Jaechul Roh, Deepak Chandran, Amir Houmansadr +1Language Model Safety Evaluation Jailbreak Attacks
University of Massachusetts Amherst · Dolby Laboratories
Does Deeper Reasoning Compromise Alignment? Revealing and Mitigating of Alignment Collapse in Large Reasoning Models
Sep 8, 2026Yu-Hang Wu, Yu-Jie Xiong, Henghua Zhang +3Adversarial Attacks on LLMs Jailbreak Attacks
Shanghai University of Engineering Science · The Hong Kong University of Science and Technology · A * STAR
SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement
Sep 5, 2026Quoc Viet Vo, Trung Le, Damith C. Ranasinghe +1LLM Security Jailbreak Attacks
Australian Institute for Machine Learning · Adelaide University · Monash University
The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal
Aug 31, 2026Md Mokarram Chowdhury, Ernie Chang, Yang LiJailbreak Attacks LLM Jailbreak Attacks
Department of Computer Science, Iowa State University, United States · Meta, United States
TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models
Aug 27, 2026Qi Lu, Zehui Guo, David Yuanda Gan +4Jailbreak Attacks Image-to-Video Generation
School of Cyber Science and Engineering, Huazhong University of Science and Technology · School of Mathematical Sciences, Peking University · School of Software and engineering, Huazhong University of Science and Technology +1
PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies
Aug 24, 2026Zeyu Feng, Qingyu Wu, Yuzhe Luo +1Jailbreak Attacks Adversarial Attacks on LLMs
The Defense Innovation Institute, Academy of Military Sciences, Beijing, China
Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks
Aug 22, 2026Aaditya Pratap, Harsh Kasyap, Somanath TripathyJailbreak Defense LLM Safety Evaluation
NCE Chandi Nalanda, India · IIT (BHU) Varanasi, India · IIT Patna Patna, India
Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets
Aug 18, 2026Zhida He, Xiaoyu Wen, Han Qi +5Jailbreak Attacks LLM Jailbreak Attacks
Shanghai AI Laboratory · Fudan University · Shanghai Jiao Tong University
ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
Aug 4, 2026Hujian Zhu, Yihao Huang, Felix Juefei-Xu +5Adversarial Attacks on LLMs Jailbreak Attacks
East China Normal University, Shanghai, China · New York University, New York, USA · The Hong Kong Polytechnic University, Hong Kong, China +2
Depth, Not Breadth: Best-of-N Jailbreaking Beyond Surface Noise
Jul 29, 2026Haoyu Zhang, Hanwen Liu, Yang Chen +9Adversarial Attacks Jailbreak Attacks
1Northeastern University
Geometric Configurations of Perturbed Jailbreak Prompts
Jul 22, 2026Lynn Delcon, Andres Algaba, Vincent GinisJailbreak Attacks LLM Jailbreak Attacks
Department of Business Technology and Operations, Data Analytics Laboratory, Vrije Universiteit Brussel, Pleinlaan 2, 1050 Brussels, Belgium · imec-SMIT, Vrije Universiteit Brussel, Pleinlaan 9, 1050 Brussels, Belgium · School of Engineering and Applied Sciences, Harvard University, Cambridge, Massachusetts 02138, USA
Adversarial Prompting Framework for AI Safety Assessment
Jul 15, 2026Yash Bhatnagar, Kunal Banerjee, Anirban ChatterjeeAdversarial Prompt Generation Adversarial Attacks on LLMs
Microsoft · Bengaluru, Karnataka, India · Walmart Global Tech
Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safety
Jul 11, 2026Chigozirim Ifebi, Brent Kong, Ayushi MehrotraLLM Safety Benchmarks Multilingual Language Model Evaluation
California Institute of Technology.
Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agents
Jul 4, 2026Abhishek Kumar, Carsten MapleLanguage Model Safety Evaluation AI Coding Agents
The Alan Turing Institute, London, United Kingdom

Oct 28, 2026J/K move · Enter open · S save

Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak

Xu Zhang, Ziqing Hu, Shuo Han, Ren Wang

Illinois Institute of Technology, Chicago, IL, USA · Perplexity AI · University of Illinois Chicago, Chicago, IL, USA

Jailbreak Attacks Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models Adversarial Transferability

Open paper AskPDF arXiv

Multimodal large language models (MLLMs) are vulnerable to visual jailbreak attacks that bypass safety safeguards. Existing methods typically optimize isolated adversarial examples, limiting attack diversity, transferability, and generalization. We propose Jailbreak Connectivity (JC), a framework based on the observation that effective adversarial inputs can be connected through low-loss regions in image space. JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries. On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points. In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively. These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.