mlsanityData to 7 Oct 2026

Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs

arXiv 2402.14872 ↗First posted 21 Feb 2024cs.CL cs.AI cs.NEcited by 48

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs), used in creative writing, code generation, and translation, generate text based on input sequences but are vulnerable to jailbreak attacks, where crafted prompts induce harmful outputs. Most jailbreak prompt methods use a combination of jailbreak templates followed by questions to ask to create jailbreak prompts. However, existing jailbreak prompt designs generally suffer from excessive semantic differences, resulting in an inability to resist defenses that use simple semantic metrics as thresholds. Jailbreak prompts are semantically more varied than the original questions used for queries. In this paper, we introduce a Semantic Mirror Jailbreak (SMJ) approach that bypasses LLMs by generating jailbreak prompts that are semantically similar to the original question. We model the search for jailbreak prompts that satisfy both semantic similarity and jailbreak validity as a multi-objective optimization problem and employ a standardized set of genetic algorithms for generating eligible prompts. Compared to the baseline AutoDAN-GA, SMJ achieves attack success rates (ASR) that are at most 35.4% higher without ONION defense and 85.2% higher with ONION defense. SMJ's better performance in all three semantic meaningfulness metrics of Jailbreak Prompt, Similarity, and Outlier, also means that SMJ is resistant to defenses that use those metrics as thresholds.

Key facts. Cited by 48 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 27 of its 46 references that are in the map. First posted on arXiv 21 Feb 2024.

Builds on

27 of 46 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  3. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  4. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 22

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  3. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,355
  4. 2023A Multitask, Multilingual, Multimodal Evaluation of ChatGPT on Reasoning, Hallucination, and Interactivitycited by 888
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  6. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  7. 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 282
  8. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  9. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  10. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  11. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  12. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
10 more
  1. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  2. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  3. 2020Efficient Adversarial Attacks for Visual Object Trackingcited by 66
  4. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
  5. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  6. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  7. 2022Exploring the Relationship between Architecture and Adversarially Robust Generalizationcited by 23
  8. 2023Improving Adversarial Transferability by Stable Diffusioncited by 22
  9. 2023To ChatGPT, or not to ChatGPT: That is the question!cited by 20
  10. 2022Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentationcited by 19

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 12; 2025: 23; 2026: 13.

48 papers.

Sort:

By area:

  1. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 215
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  3. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  4. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 61
  5. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  6. 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructionscited by 33
  7. 2024JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Modelscited by 28
  8. 2024Towards Robust Physical-world Backdoor Attacks on Lane Detectioncited by 25
  9. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMscited by 21
  10. 2024PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMscited by 20
  11. 2024LanEvil: Benchmarking the Robustness of Lane Detection to Environmental Illusionscited by 18
  12. 2025T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attackscited by 18
36 more
  1. 2025T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Modelscited by 17
  2. 2025SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identificationcited by 14
  3. 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agentscited by 14
  4. 2025One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMscited by 12
  5. 2025SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compressioncited by 12
  6. 2025GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methodscited by 9
  7. 2025Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attackcited by 9
  8. 2025SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinationscited by 9
  9. 2025Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Cipherscited by 8
  10. 2024JailbreakLens: Visual Analysis of Jailbreak Attacks Against Large Language Modelscited by 7
  11. 2024LLM-Virus: Evolutionary Jailbreak Attack on Large Language Modelscited by 7
  12. 2026Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMscited by 6
  13. 2025OMNIGUARD: An Efficient Approach for AI Safety Moderation Across Languages and Modalitiescited by 5
  14. 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?cited by 5
  15. 2025Active Attacks: Red-teaming LLMs via Adaptive Environmentscited by 5
  16. 2024Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysiscited by 4
  17. 2025KDA: A Knowledge-Distilled Attacker for Generating Diverse Prompts to Jailbreak LLMscited by 4
  18. 2025VERA: Variational Inference Framework for Jailbreaking Large Language Modelscited by 4
  19. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 4
  20. 2026StealthGraph: Exposing Domain-Specific Risks in LLMs through Knowledge-Graph-Guided Harmful Prompt Generationcited by 4
  21. 2025Online Learning Defense against Iterative Jailbreak Attacks via Prompt Optimizationcited by 3
  22. 2026Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systemscited by 3
  23. 2025When Testing AI Tests Us: Safeguarding Mental Health on the Digital Frontlinescited by 2
  24. 2025Active Honeypot Guardrail System: Probing and Confirming Multi-Turn LLM Jailbreakscited by 2
  25. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Modelscited by 2
  26. 2025SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Modelscited by 1
  27. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  28. 2026Evolving Deception: When Agents Evolve, Deception Winscited by 1
  29. 2026Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMscited by 1
  30. 2026Multimodal Backdoor Attack on VLMs for Autonomous Driving via Graffiti and Cross-Lingual Triggerscited by 1
  31. 2026Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspectivecited by 1
  32. 2026Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversioncited by 0
  33. 2026On the Hardness of Junking LLMscited by 0
  34. 2026Breadcrumbing Search Agentscited by 0
  35. 2026SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defensecited by 0
  36. 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attackscited by 0