mlsanityData to 7 Oct 2026

Endless Jailbreaks with Bijection Learning

arXiv 2410.01294 ↗First posted 2 Oct 2024cs.CLcited by 18

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Despite extensive safety measures, LLMs are vulnerable to adversarial inputs, or jailbreaks, which can elicit unsafe behaviors. In this work, we introduce bijection learning, a powerful attack algorithm which automatically fuzzes LLMs for safety vulnerabilities using randomly-generated encodings whose complexity can be tightly controlled. We leverage in-context learning to teach models bijective encodings, pass encoded queries to the model to bypass built-in safety mechanisms, and finally decode responses back into English. Our attack is extremely effective on a wide range of frontier language models. Moreover, by controlling complexity parameters such as number of key-value mappings in the encodings, we find a close relationship between the capability level of the attacked LLM and the average complexity of the most effective bijection attacks. Our work highlights that new vulnerabilities in frontier models can emerge with scale: more capable models are more severely jailbroken by bijection attacks.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 42 of its 57 references that are in the map. First posted on arXiv 2 Oct 2024.

Builds on

42 of 57 references.

Closest ancestors · 22

Same direction, newest first

  1. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  2. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs22 Jul
  3. 2024Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters30 May
  4. 2024Efficient Adversarial Training in LLMs with Continuous Attacks24 May
  5. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  6. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  7. 2024Testing the Limits of Jailbreaking Defenses with the Purple Problem20 Mar
  8. 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling2 Mar
  9. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  10. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  11. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks30 Jan
  12. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
10 more
  1. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  2. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  3. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  4. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  5. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  6. 2023Low-Resource Languages Jailbreak GPT-43 Oct
  7. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  8. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  10. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 20

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  3. 2017Deep reinforcement learning from human preferencescited by 3,846
  4. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  5. 2022Emergent Abilities of Large Language Modelscited by 2,483
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  7. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  8. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  10. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  11. 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 224
  12. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
8 more
  1. 2023Understanding Catastrophic Forgetting in Language Models via Implicit Inferencecited by 138
  2. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 74
  3. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
  4. 2024Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Trainingcited by 67
  5. 2022Adversarial Training for High-Stakes Reliabilitycited by 60
  6. 2024Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress?cited by 56
  7. 2024Mission: Impossible Language Modelscited by 31
  8. 2024FLRT: Fluent Student-Teacher Redteamingcited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 9; 2026: 7.

18 papers.

Sort:

By area:

  1. 2024Best-of-N Jailbreakingcited by 71
  2. 2025Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactionscited by 14
  3. 2025Towards Safeguarding LLM Fine-tuning APIs against Cipher Attackscited by 10
  4. 2025Jailbreaking to Jailbreakcited by 8
  5. 2025Discovering Forbidden Topics in Language Modelscited by 8
  6. 2025Should LLM Safety Be More Than Refusing Harmful Instructions?cited by 6
  7. 2025Bypassing Prompt Guards in Production with Controlled-Release Promptingcited by 6
  8. 2026Knowledge-Driven Multi-Turn Jailbreaking on Large Language Modelscited by 6
  9. 2024Plentiful Jailbreaks with String Compositionscited by 4
  10. 2025InfoFlood: Jailbreaking Large Language Models with Information Overloadcited by 2
  11. 2026AlienLM: Alienization of Language for API-Boundary Privacy in Black-Box LLMscited by 2
  12. 2025A Generative Approach to LLM Harmfulness Mitigation with Red Flag Tokenscited by 1
6 more
  1. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  2. 2026Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Promptingcited by 1
  3. 2026Jailbreaking LLMs via Calibrationcited by 0
  4. 2026Single-Configuration Attack Success Rate Is Not Enough: Jailbreak Evaluations Should Report Distributional Attack Successcited by 0
  5. 2026Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agentscited by 0
  6. 2026LLM Alignment--Utility Asymmetry under Semantic-Preserving Transformationscited by 0