LLM Jailbreak Attacks

LLM: Large Language Model

LLM jailbreak research examines how prompts and interactions can circumvent safety alignment, and how to make models resist those attempts. Attacks range from roleplay, obfuscation, and multi-turn persuasion to automated prompt optimization, internal activation steering, and attacks on audio, code, and tool-using agents. Defenses include input filters, intent detectors, safety fine-tuning, representation-level interventions, and safeguards that track risk across a conversation; evaluations increasingly test diverse languages, adaptive attacks, and harmful actions that actually execute. A central challenge is improving robustness without rejecting benign requests, while inconsistent judges, budgets, and test settings make reported attack success difficult to compare.

Latest papers

207 papers25 papers in the last four weeks, up 79% on the four weeks before. 0.1% of all new papers.

Reasoning-targeted Jailbreak Attacks on Large Reasoning Models via Semantic Triggers and Psychological Framing
Apr 17, 2026Zehao Wang, Lanjun WangAdversarial Prompt Generation Jailbreak Attacks
College of Intelligence and Computing, Tianjin University, Tianjin 300350, China. · School of New Media and Communication, Tianjin University, Tianjin 300072, China. · Shanghai Key Laboratory of Data Science,[cs.LG] Shanghai 200438, China.
Segment-Level Coherence for Robust Harmful Intent Probing in LLMs
Apr 16, 2026Xuanli He, Bilgehan Sel, Faizan Ali +3LLM Safety LLM Jailbreak Attacks
University College London · Virginia Tech · Anthropic
TEMPLATEFUZZ: Fine-Grained Chat Template Fuzzing for Jailbreaking and Red Teaming LLMs
Apr 14, 2026Qingchao Shen, Zibo Xiao, Lili Huang +3Adversarial Attacks on LLMs LLM Security
School of Computer Software, Tianjin University, Tianjin, China · Monash University, Monash, Australia
The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems
Apr 13, 2026Yihao Zhang, Kai Wang, Jiangrong Wu +7LLM Security LLM Jailbreak Attacks
School of Mathematical Sciences, Peking University · Sun Yat-sen University · Wuhan University +3
Latent Instruction Representation Alignment: defending against jailbreaks, backdoors and undesired knowledge in LLMs
Apr 12, 2026Eric Easley, Sebastian FarquharBackdoor Defense in LLMs LLM Jailbreak Attacks
ML Alignment & Theory Scholars Berkeley, CA, USA · OATML, Department of Computer Science University of Oxford, Oxford, UK
Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion
Apr 11, 2026Vishal Pramanik, Maisha Maliha, Susmit Jha +1Adversarial Attacks on LLMs LLM Jailbreak Attacks
Department of Computer & Information Science & Engineering, University of Florida, Gainesville, FL 32611, USA · School of Computer Science, University of Oklahoma, Norman, OK 73019, USA · Computer Science Laboratory, SRI International, Menlo Park, CA 94025, USA
GRM: Utility-Aware Jailbreak Attacks on Audio LLMs via Gradient-Ratio Masking
Apr 10, 2026Yunqiang Wang, Hengyuan Na, Di Wu +2LLM Jailbreak Attacks Adversarial Perturbations
Sun Yat-Sen University Guangzhou Yunshan Research Institute of Artificial Intelligence Security Guangzhou, China · Sun Yat-Sen University Guangzhou, China
Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward
Apr 10, 2026Weiyang Guo, Zesheng Shi, Zeen Zhu +3LLM Backdoor Attacks LLM Jailbreak Attacks
Harbin Institute of Technology, Shenzhen, China · Huawei Technologies Co., Ltd.
Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents
Apr 7, 2026Yanxu Mao, Peipei Liu, Tiehan Cui +3LLM Red Teaming LLM Agent Security
School of Software, Henan University, China · Institute of Information Engineering, Chinese Academy of Sciences, China · University of Chinese Academy of Sciences, China +1
How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models
Apr 6, 2026Gregory N. FrankLLM Interpretability LLM Safety
Chief Scientist, Molt AI Corp.
CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders
Apr 2, 2026Su-Hyeon Kim, Hyundong Jin, Yejin Lee +1Refusal Behavior in Language Models Mechanistic Interpretability
Yonsei University, Seoul, Republic of Korea
SelfGrader: LLM Jailbreak Detection via Anchored Token-Level Logits
Apr 1, 2026Zikai Zhang, Rui Hu, Olivera Kotevska +1LLM Guardrails LLM Security
Department of Computer Science and Engineering, University of Nevada, Reno, Reno, USA · Oak Ridge National Laboratory, Oak Ridge, USA
One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety
Apr 1, 2026Samee Arif, Naihao Deng, Zhijing Jin +1LLM Jailbreak Attacks Language Model Safety Evaluation
University of Michigan · University of Toronto
GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Models
Mar 28, 2026Md Jueal Mia, Joaquin Molto, Yanzhao Wu +1Jailbreak Defense Jailbreak Detection
Knight Foundation School of Computing and Information Sciences Florida International University Miami, FL, USA · Security, Optimization, and Learning for InterDependent networks laboratory (solid lab) Florida International University Miami, FL, USA
Analysing the Safety Pitfalls of Steering Vectors
Mar 25, 2026Yuxiao Li, Alina Fastowski, Efstratios Zaradoukas +2Activation Steering Language Model Safety Evaluation
Technical University of Munich, Munich Center for Machine Learning
Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs
Mar 24, 2026Wenyu Chen, Xiangtao Meng, Chuanchao Zang +6LLM Security LLM Jailbreak Attacks
Shandong University
Evolving Jailbreaks: Automated Multi-Objective Long-Tail Attacks on Large Language Models
Mar 20, 2026Wenjing Hong, Zhonghua Rong, Li Wang +5Jailbreak Attacks LLM Jailbreak Attacks
School of Artificial Intelligence Shenzhen Univeristy, China · Brain-Inspired Technology Co.,Ltd, China · Department of Computer Science and Engineering Southern University of Science and Technology, China +1
On Optimizing Multimodal Jailbreaks for Spoken Language Models
Mar 19, 2026Aravind Krishnan, Karolina Stańczak, Dietrich KlakowAdversarial Attacks LLM Jailbreak Attacks
Saarland University, Germany · DFKI GmbH, Saarbrücken, Germany · ETH AI Center, Switzerland
Structured Semantic Cloaking for Jailbreak Attacks on Large Language Models
Mar 17, 2026Xiaobing Sun, Perry Lam, Shaohua Li +4Adversarial Attacks on LLMs LLM Jailbreak Attacks
Institute of High Performance Computing (IHPC), Agency for Science, Technology and Research (A*STAR), Singapore. · Information Systems Technology and Design Pillar, Singapore University of Technology and Design.
Exposing Long-Tail Safety Failures in Large Language Models through Efficient Diverse Response Sampling
Mar 15, 2026Suvadeep Hajra, Palash Nandi, Tanmoy ChakrabortyLLM Safety LLM Red Teaming
Department of Electrical Engineering, Indian Institute of Technology Delhi · Yardi School of Artificial Intelligence, Indian Institute of Technology Delhi
Accelerating Suffix Jailbreak attacks with Prefix-Shared KV-cache
Mar 12, 2026Xinhai Wang, Shaopeng Fu, Shu Yang +3Jailbreak Attacks LLM Jailbreak Attacks
King Abdullah University of Science and Technology (KAUST) · Zhejiang University
Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models
Mar 11, 2026Xiangwen Wang, Ananth Balashankar, Varun ChandrasekaranJailbreak Attacks LLM Jailbreak Attacks
University of Illinois Urbana-Champaign · Google DeepMind
Multi-Stream Perturbation Attack: Breaking Safety Alignment of Thinking LLMs Through Concurrent Task Interference
Mar 10, 2026Fan YangAdversarial Attacks on LLMs LLM Jailbreak Attacks
Jinan University
Amnesia: Adversarial Semantic Layer Specific Activation Steering in Large Language Models
Mar 10, 2026Ali Raza, Gurang Gupta, Nikolay Matyunin +1Adversarial Attacks on LLMs LLM Jailbreak Attacks
Honda Research Institute Europe Offenbach, Hesse, Germany · IIT KharagPur Kharagpur, India
The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs
Mar 9, 2026Yonghong Deng, Zhen Yang, Ping Jian +4LLM Jailbreak Attacks LLM Safety Alignment
School of Computer Science and Technology, Beijing Institute of Technology, Beijing, China · Beike Language and Intelligence, Beijing, China
Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Models
Mar 6, 2026Jinman Wu, Yi Xie, Shen Lin +2Refusal Mechanisms in Language Models LLM Safety Alignment
Xidian University, Xi’an, China · Tsinghua University, Shenzhen, China · Fujian Normal University, Fuzhou, China +1
Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads
Mar 6, 2026Jinman Wu, Yi Xie, Shiqian Zhao +1Adversarial Attacks on LLMs LLM Jailbreak Attacks
Xidian University, Xi’an, China · Tsinghua University, Shenzhen, China · Nanyang Technological University, Singapore
TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models
Mar 3, 2026Zhi Xu, Jiaqi Li, Xiaotong Zhang +2Adversarial Attacks on LLMs Jailbreak Attacks
Dalian University of Technology, Dalian, China
From Shallow to Deep: Pinning Semantic Intent via Causal GRPO
Mar 3, 2026Shuyi Zhou, Zeen Song, Wenwen Qiang +4LLM Alignment Adversarial Robustness of Language Models
University of Chinese Academy of Sciences, Beijing, China · Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · Institute of Software, Chinese Academy of Sciences, Beijing, China
JailNewsBench: Multi-Lingual and Regional Benchmark for Fake News Generation under Jailbreak Attacks
Mar 1, 2026Masahiro Kaneko, Ayana Niwa, Timothy BaldwinLLM Safety Benchmarks LLM Jailbreak Attacks
MBZUAI

Apr 17, 2026J/K move · Enter open · S save

Reasoning-targeted Jailbreak Attacks on Large Reasoning Models via Semantic Triggers and Psychological Framing

Zehao Wang, Lanjun Wang

College of Intelligence and Computing, Tianjin University, Tianjin 300350, China. · School of New Media and Communication, Tianjin University, Tianjin 300072, China. · Shanghai Key Laboratory of Data Science,[cs.LG] Shanghai 200438, China.

Adversarial Prompt Generation Jailbreak Attacks LLM Jailbreak Attacks Large Reasoning Models

Open paper AskPDF arXiv

Large Reasoning Models (LRMs) have demonstrated strong capabilities in generating step-by-step reasoning chains alongside final answers, enabling their deployment in high-stakes domains such as healthcare and education. While prior jailbreak attack studies have focused on the safety of final answers, little attention has been given to the safety of the reasoning process. In this work, we identify a novel problem that injects harmful content into the reasoning steps while preserving unchanged answers. This type of attack presents two key challenges: 1) manipulating the input instructions may inadvertently alter the LRM's final answer, and 2) the diversity of input questions makes it difficult to consistently bypass the LRM's safety alignment mechanisms and embed harmful content into its reasoning process. To address these challenges, we propose the Psychology-based Reasoning-targeted Jailbreak Attack (PRJA) Framework, which integrates a Semantic-based Trigger Selection module and a Psychology-based Instruction Generation module. Specifically, the proposed PRJA automatically selects manipulative reasoning triggers via semantic analysis and leverages psychological theories of obedience to authority and moral disengagement to generate adaptive instructions for enhancing the LRM's compliance with harmful content generation. Extensive experiments on five question-answering datasets demonstrate that PRJA achieves an average attack success rate of 83.6% against several commercial LRMs, including DeepSeek R1, Qwen2.5-Max, and OpenAI o4-mini.