mlsanityData to 14 Oct 2026

You Know What I'm Saying: Jailbreak Attack via Implicit Reference

arXiv 2410.03857 ↗First posted 4 Oct 2024cs.CLcited by 14

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

While recent advancements in large language model (LLM) alignment have enabled the effective identification of malicious objectives involving scene nesting and keyword rewriting, our study reveals that these methods remain inadequate at detecting malicious objectives expressed through context within nested harmless objectives. This study identifies a previously overlooked vulnerability, which we term Attack via Implicit Reference (AIR). AIR decomposes a malicious objective into permissible objectives and links them through implicit references within the context. This method employs multiple related harmless objectives to generate malicious content without triggering refusal responses, thereby effectively bypassing existing detection techniques.Our experiments demonstrate AIR's effectiveness across state-of-the-art LLMs, achieving an attack success rate (ASR) exceeding 90% on most models, including GPT-4o, Claude-3.5-Sonnet, and Qwen-2-72B. Notably, we observe an inverse scaling phenomenon, where larger models are more vulnerable to this attack method. These findings underscore the urgent need for defense mechanisms capable of understanding and preventing contextual attacks. Furthermore, we introduce a cross-model attack strategy that leverages less secure models to generate malicious contexts, thereby further increasing the ASR when targeting other models.Our code and jailbreak artifacts can be found at https://github.com/Lucas-TY/llm_Implicit_reference.

Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 57 of its 69 references that are in the map. First posted on arXiv 4 Oct 2024.

Builds on

57 of 69 references.

Closest ancestors · 25

Same direction, newest first

  1. 2024PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approach21 Sep
  2. 2024Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks29 Aug
  3. 2024StructuralSleight: Automated Jailbreak Attacks on Large Language Models Utilizing Uncommon Text-Organization Structures13 Jun
  4. 2024Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters30 May
  5. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  6. 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models26 Feb
  7. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
  8. 2024Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks14 Feb
  9. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  10. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  11. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
  12. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
13 more
  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  2. 2023Multilingual Jailbreak Challenges in Large Language Models10 Oct
  3. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  4. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  5. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  6. 2023FuzzLLM: A Novel and Universal Fuzzing Framework for Proactively Discovering Jailbreak Vulnerabilities in Large Language Models11 Sep
  7. 2023Certifying LLM Safety against Adversarial Prompting6 Sep
  8. 2023Detecting Language Model Attacks with Perplexity27 Aug
  9. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  11. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
  12. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul
  13. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study23 May

Other references · 32

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  6. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  7. 2017Deep reinforcement learning from human preferencescited by 3,912
  8. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,568
  9. 2023Sparks of Artificial General Intelligence: Early experiments with GPT-4cited by 2,592
  10. 2024Qwen2 Technical Reportcited by 2,120
  11. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  12. 2022Red Teaming Language Models with Language Modelscited by 1,026
20 more
  1. 2023Can Large Language Models Be an Alternative to Human Evaluations?cited by 734
  2. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  4. 2023Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyondcited by 411
  5. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
  6. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  7. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 297
  8. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 273
  9. 2023The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learningcited by 257
  10. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 244
  11. 2023Inverse Scaling: When Bigger Isn't Bettercited by 207
  12. 2023Is ChatGPT A Good Translator? Yes With GPT-4 As The Enginecited by 176
  13. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 79
  14. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 77
  15. 2023Attack Prompt Generation for Red Teaming and Defending Large Language Modelscited by 76
  16. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 68
  17. 2024Enhancing LLM Safety via Constrained Direct Preference Optimizationcited by 49
  18. 2024Navigating the OverKill in Large Language Modelscited by 44
  19. 2024Configurable Safety Tuning of Language Models with Synthetic Preference Datacited by 14
  20. 2024Towards Safety and Helpfulness Balanced Responses via Controllable Large Language Modelscited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 8; 2026: 6.

14 papers.

Sort:

By area:

  1. 2025Are Smarter LLMs Safer? Exploring Safety-Reasoning Trade-offs in Prompting and Fine-Tuningcited by 20
  2. 2025Improving Large Language Model Safety with Contrastive Representation Learningcited by 8
  3. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoningcited by 8
  4. 2025Adversarial D'ej`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attackscited by 7
  5. 2025The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Searchcited by 7
  6. 2026Gated Differentiable Working Memory for Long-Context Language Modelingcited by 6
  7. 2025Behind the Mask: Benchmarking Camouflaged Jailbreaks in Large Language Modelscited by 2
  8. 2026COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMscited by 2
  9. 2026Jailbreak Foundry: From Papers to Runnable Attacks for Reproducible Benchmarkingcited by 2
  10. 2025Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoningcited by 1
  11. 2026The Shadow Self: Intrinsic Value Misalignment in Large Language Model Agentscited by 1
  12. 2025Distillability of LLM Security Logic: Predicting Attack Success Rate of Outline Filling Attack via Ranking Regressioncited by 0
2 more
  1. 2026V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failurecited by 0
  2. 2026Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defensecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Beyond Jailbreaks: Revealing Stealthier and Broader LLM Security Risks Stemming from Alignment Failures
  2. 2026ICON: Intent-Context Coupling for Efficient Multi-Turn Jailbreak Attack
  3. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
  4. 2026The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems
  5. 2025When Harmless Words Harm: A New Threat to LLM Safety via Conceptual Triggers
  6. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models
  7. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles
  8. 2025Context Misleads LLMs: The Role of Context Filtering in Maintaining Safe Alignment of LLMs