mlsanityData to 7 Oct 2026

BitBypass: A New Direction in Jailbreaking Aligned Large Language Models with Bitstream Camouflage

arXiv 2506.02479 ↗First posted 3 Jun 2025cs.CR cs.CLcited by 2

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

The inherent risk of generating harmful and unsafe content by Large Language Models (LLMs), has highlighted the need for their safety alignment. Various techniques like supervised fine-tuning, reinforcement learning from human feedback, and red-teaming were developed for ensuring the safety alignment of LLMs. However, the robustness of these aligned LLMs is always challenged by adversarial attacks that exploit unexplored and underlying vulnerabilities of the safety alignment. In this paper, we develop a novel black-box jailbreak attack, called BitBypass, that leverages hyphen-separated bitstream camouflage for jailbreaking aligned LLMs. This represents a new direction in jailbreaking by exploiting fundamental information representation of data as continuous bits, rather than leveraging prompt engineering or adversarial manipulations. Our evaluation of five state-of-the-art LLMs, namely GPT-4o, Gemini 1.5, Claude 3.5, Llama 3.1, and Mixtral, in adversarial perspective, revealed the capabilities of BitBypass in bypassing their safety alignment and tricking them into generating harmful and unsafe content. Further, we observed that BitBypass outperforms several state-of-the-art jailbreak attacks in terms of stealthiness and attack success. Overall, these results highlights the effectiveness and efficiency of BitBypass in jailbreaking these state-of-the-art LLMs.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 47 of its 70 references that are in the map. First posted on arXiv 3 Jun 2025.

Builds on

47 of 70 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
  2. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 44

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2023GPT-4 Technical Reportcited by 18,132
  4. 2022Training language models to follow instructions with human feedbackcited by 15,712
  5. 2024The Llama 3 Herd of Modelscited by 14,192
  6. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  7. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  8. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  9. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  10. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  11. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
  12. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
32 more
  1. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  2. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  3. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,928
  4. 2022Challenging BIG-Bench Tasks and Whether Chain-of-Thought Can Solve Themcited by 1,767
  5. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  8. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  9. 2019PEGASUS: Pre-training with Extracted Gap-sentences for Abstractive Summarizationcited by 1,100
  10. 2022Program of Thoughts Prompting: Disentangling Computation from Reasoning for Numerical Reasoning Taskscited by 1,057
  11. 2020Multilingual Denoising Pre-training for Neural Machine Translationcited by 1,028
  12. 2023BloombergGPT: A Large Language Model for Financecited by 923
  13. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  14. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  15. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  16. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
  17. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 337
  18. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 242
  19. 2024LLMs instead of Human Judges? A Large Scale Empirical Study across 20 NLP Evaluation Taskscited by 236
  20. 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 224
  21. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  22. 2022Fine-tuning language models to find agreement among humans with diverse preferencescited by 189
  23. 2023Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMscited by 176
  24. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 162
  25. 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teamingcited by 161
  26. 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversationscited by 118
  27. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 111
  28. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstructioncited by 95
  29. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principlescited by 54
  30. 2024Boosting Jailbreak Attack with Momentumcited by 38
  31. 2024ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddingscited by 31
  32. 2024GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanationcited by 24

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Invisible Safety Threat: Malicious Finetuning for LLM via Steganographycited by 2
  2. 2026Evaluating Jailbreaking Vulnerabilities in LLMs Deployed as Assistants for Smart Grid Operations: A Benchmark Against NERC Standardscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  2. 2024PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips
  3. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  4. 2025Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction
  5. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy
  6. 2024Defending against Jailbreak through Early Exit Generation of Large Language Models
  7. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment
  8. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks