mlsanityData to 14 Oct 2026

FlipAttack: Jailbreak LLMs via Flipping

arXiv 2410.02832 ↗First posted 2 Oct 2024cs.CR cs.AIcited by 80

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

This paper proposes a simple yet effective jailbreak attack named FlipAttack against black-box LLMs. First, from the autoregressive nature, we reveal that LLMs tend to understand the text from left to right and find that they struggle to comprehend the text when noise is added to the left side. Motivated by these insights, we propose to disguise the harmful prompt by constructing left-side noise merely based on the prompt itself, then generalize this idea to 4 flipping modes. Second, we verify the strong ability of LLMs to perform the text-flipping task, and then develop 4 variants to guide LLMs to denoise, understand, and execute harmful behaviors accurately. These designs keep FlipAttack universal, stealthy, and simple, allowing it to jailbreak black-box LLMs within only 1 query. Experiments on 8 LLMs demonstrate the superiority of FlipAttack. Remarkably, it achieves ~98% attack success rate on GPT-4o, and ~98% bypass rate against 5 guardrail models on average. The codes are available at GitHubfootnotehttps://github.com/yueliu1999/FlipAttack.

Key facts. Cited by 80 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 93 of its 128 references that are in the map. First posted on arXiv 2 Oct 2024.

Builds on

93 of 128 references.

Closest ancestors · 40

Same direction, newest first

  1. 2024Probing the Safety Response Boundary of Large Language Models via Unsafe Decoding Path Generation20 Aug
  2. 2024Badllama 3: removing safety finetuning from Llama 3 in minutes1 Jul
  3. 2024Poisoned LangChain: Jailbreak LLMs by LangChain26 Jun
  4. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses3 Jun
  5. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
  6. 2024GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation21 May
  7. 2024Boosting Jailbreak Attack with Momentum2 May
  8. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs21 Apr
  9. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  10. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  11. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  12. 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models26 Mar
28 more
  1. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  2. 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models26 Feb
  3. 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers25 Feb
  4. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
  5. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  6. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  7. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding14 Feb
  8. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
  9. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  10. 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking16 Nov
  11. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
  12. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  13. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  14. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models23 Oct
  15. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  16. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  17. 2023Multilingual Jailbreak Challenges in Large Language Models10 Oct
  18. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  19. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  20. 2023Low-Resource Languages Jailbreak GPT-43 Oct
  21. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  22. 2023FuzzLLM: A Novel and Universal Fuzzing Framework for Proactively Discovering Jailbreak Vulnerabilities in Large Language Models11 Sep
  23. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Models4 Sep
  24. 2023Detecting Language Model Attacks with Perplexity27 Aug
  25. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  26. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  27. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
  28. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 53

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  7. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
  8. 2022Training Compute-Optimal Large Language Modelscited by 3,019
  9. 2022Self-Instruct: Aligning Language Models with Self-Generated Instructionscited by 2,724
  10. 2019Fine-Tuning Language Models from Human Preferencescited by 2,150
  11. 2024Mixtral of Expertscited by 1,823
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
38 more
  1. 2024Qwen2.5-Coder Technical Reportcited by 1,203
  2. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  3. 2022Super-NaturalInstructions: Generalization via Declarative Instructions on 1600+ NLP Taskscited by 868
  4. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 729
  5. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
  6. 2023Textbooks Are All You Needcited by 569
  7. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 518
  8. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  9. 2021Recursively Summarizing Books with Human Feedbackcited by 290
  10. 2022PromptSource: An Integrated Development Environment and Repository for Natural Language Promptscited by 289
  11. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  12. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 273
  13. 2023Pretraining Language Models with Human Preferencescited by 247
  14. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
  15. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  16. 2021Process for Adapting Language Models to Society (PALMS) with Values-Targeted Datasetscited by 181
  17. 2020Recipes for Safety in Open-domain Chatbotscited by 170
  18. 2021Challenges in Detoxifying Language Modelscited by 169
  19. 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teamingcited by 163
  20. 2022COLD Decoding: Energy-based Constrained Text Generation with Langevin Dynamicscited by 161
  21. 2023RAIN: Your Language Models Can Align Themselves without Finetuningcited by 157
  22. 2023Universal Jailbreak Backdoors from Poisoned Human Feedbackcited by 128
  23. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 125
  24. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 116
  25. 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 116
  26. 2024Revolutionizing Finance with LLMs: An Overview of Applications and Insightscited by 90
  27. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  28. 2024Curiosity-driven Red-teaming for Large Language Modelscited by 88
  29. 2024Detoxifying Large Language Models via Knowledge Editingcited by 87
  30. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 80
  31. 2022Exploring the Limits of Domain-Adaptive Training for Detoxifying Large-Scale Language Modelscited by 68
  32. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
  33. 2024Explaining Length Bias in LLM-Based Preference Evaluationscited by 49
  34. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 45
  35. 2024Editable Concept Bottleneck Modelscited by 23
  36. 2024Semi-supervised Concept Bottleneck Modelscited by 21
  37. 2023On the Trade-off of Intra-/Inter-class Diversity for Supervised Pre-trainingcited by 14
  38. 2024LangGPT: Rethinking Structured Reusable Prompt Design Framework for LLMs from the Programming Languagecited by 12

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 38; 2026: 41.

80 papers.

Sort:

By area:

  1. 2025RoboBrain: A Unified Brain Model for Robotic Manipulation from Abstract to Concretecited by 135
  2. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  3. 2025GuardReasoner: Towards Reasoning-based LLM Safeguardscited by 100
  4. 2025AnyEdit: Edit Any Knowledge Encoded in Language Modelscited by 76
  5. 2025Efficient Inference for Large Reasoning Models: A Surveycited by 61
  6. 2025AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraintcited by 49
  7. 2025VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agentscited by 45
  8. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 42
  9. 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directionscited by 41
  10. 2025Reinforced Lifelong Editing for Language Modelscited by 34
  11. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Modelscited by 25
  12. 2025SAFEPATH: Preventing Harmful Reasoning in Chain-of-Thought via Early Alignmentcited by 24
38 more
  1. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 21
  2. 2026MAGIC: A Co-Evolving Attacker-Defender Adversarial Game for Robust LLM Safetycited by 21
  3. 2025Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrencycited by 17
  4. 2025Alignment and Safety in Large Language Models: Safety Mechanisms, Training Paradigms, and Emerging Challengescited by 15
  5. 2025DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Modelscited by 12
  6. 2025Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderationcited by 11
  7. 2025Confusion is the Final Barrier: Rethinking Jailbreak Evaluation and Investigating the Real Misuse Threat of LLMscited by 11
  8. 2025Towards Safe AI Clinicians: A Comprehensive Study on Large Language Model Jailbreaking in Healthcarecited by 10
  9. 2025Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Modelscited by 10
  10. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoningcited by 8
  11. 2026Real Money, Fake Models: Deceptive Model Claims in Shadow APIscited by 8
  12. 2025Adversarial D'ej`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attackscited by 7
  13. 2025The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Searchcited by 7
  14. 2025ASTRA: Autonomous Spatial-Temporal Red-teaming for AI Software Assistantscited by 6
  15. 2025Confidence Elicitation: A New Attack Vector for Large Language Modelscited by 5
  16. 2025Geneshift: Impact of different scenario shift on Jailbreaking LLMcited by 5
  17. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 5
  18. 2025IntentionReasoner: Facilitating Adaptive LLM Safeguards through Intent Reasoning and Selective Query Refinementcited by 4
  19. 2026WARD: Adversarially Robust Defense of Web Agents Against Prompt Injectionscited by 4
  20. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMscited by 3
  21. 2025"To Survive, I Must Defect": Jailbreaking LLMs via the Game-Theory Scenarioscited by 3
  22. 2026Reasoning over Precedents Alongside Statutes: Case-Augmented Deliberative Alignment for LLM Safetycited by 3
  23. 2026SoK: Robustness in Large Language Models against Jailbreak Attackscited by 3
  24. 2026Do Thinking Tokens Help with Safety?cited by 3
  25. 2025Effective and Efficient Jailbreaks of Black-Box LLMs with Cross-Behavior Attackscited by 2
  26. 2025Formalization Driven LLM Prompt Jailbreaking via Reinforcement Learningcited by 2
  27. 2025Less Diverse, Less Safe: The Indirect But Pervasive Risk of Test-Time Scaling in Large Language Modelscited by 2
  28. 2025EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models via Equation Solving and Code Completioncited by 2
  29. 2026Jailbreaking Large Language Models through Iterative Tool-Disguised Attacks via Reinforcement Learningcited by 2
  30. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputscited by 2
  31. 2026Jailbreak Foundry: From Papers to Runnable Attacks for Reproducible Benchmarkingcited by 2
  32. 2026ExpGuard: LLM Content Moderation in Specialized Domainscited by 2
  33. 2026Invisible Safety Threat: Malicious Finetuning for LLM via Steganographycited by 2
  34. 2026Finding and Reactivating Post-Trained LLMs' Hidden Safety Mechanismscited by 2
  35. 2026GFlowRL: Scaling Distribution-Matching RL to Large Language Modelscited by 2
  36. 2026Benign Alone, Harmful Together: Exploiting Experience Composition in Self-Evolving LLM Agentscited by 2
  37. 2025SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Modelscited by 1
  38. 2025Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoningcited by 1

50 most cited of 80 All 80 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks
  2. 2024Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks
  3. 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
  4. 2024All in How You Ask for It: Simple Black-Box Method for Jailbreak Attacks
  5. 2025Alphabet Index Mapping: Jailbreaking LLMs through Semantic Dissimilarity
  6. 2026Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Prompting
  7. 2024SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner
  8. 2025DETAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modification