mlsanityData to 7 Oct 2026

Plentiful Jailbreaks with String Compositions

arXiv 2411.01084 ↗First posted 1 Nov 2024cs.CLcited by 4

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large language models (LLMs) remain vulnerable to a slew of adversarial attacks and jailbreaking methods. One common approach employed by white-hat attackers, or red-teamers, is to process model inputs and outputs using string-level obfuscations, which can include leetspeak, rotary ciphers, Base64, ASCII, and more. Our work extends these encoding-based attacks by unifying them in a framework of invertible string transformations. With invertibility, we can devise arbitrary string compositions, defined as sequences of transformations, that we can encode and decode end-to-end programmatically. We devise a automated best-of-n attack that samples from a combinatorially large number of string compositions. Our jailbreaks obtain competitive attack success rates on several leading frontier models when evaluated on HarmBench, highlighting that encoding-based attacks remain a persistent vulnerability even in advanced LLMs.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 19 of its 26 references that are in the map. First posted on arXiv 1 Nov 2024.

Builds on

19 of 26 references.

Closest ancestors · 13

Same direction, newest first

  1. 2024Endless Jailbreaks with Bijection Learning2 Oct
  2. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  3. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses3 Jun
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  5. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  6. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  7. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  10. 2023Low-Resource Languages Jailbreak GPT-43 Oct
  11. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  12. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
1 more
  1. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 6

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  3. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  4. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  5. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
  6. 2024FLRT: Fluent Student-Teacher Redteamingcited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 1.

4 papers.

  1. 2025Multilingual and Multi-Accent Jailbreaking of Audio LLMscited by 25
  2. 2025Exploiting Web Search Tools of AI Agents for Data Exfiltrationcited by 3
  3. 2026FinRED: An Expert-Guided Benchmark Generation and Evaluation Framework for Financial LLM Red-Teamingcited by 1
  4. 2025`A la recherche du sens perdu: your favourite LLM might have more to say than you can understandcited by 0