mlsanityData to 14 Oct 2026

MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs

arXiv 2506.22557 ↗First posted 27 Jun 2025cs.CR cs.LGcited by 4

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

As large language models (LLMs) grow more capable, they face growing vulnerability to sophisticated jailbreak attacks. While developers invest heavily in alignment finetuning and safety guardrails, researchers continue publishing novel attacks, driving progress through adversarial iteration. This dynamic mirrors a strategic game of continual evolution. However, two major challenges hinder jailbreak development: the high cost of querying top-tier LLMs and the short lifespan of effective attacks due to frequent safety updates. These factors limit cost-efficiency and practical impact of research in jailbreak attacks. To address this, we propose MetaCipher, a low-cost, multi-agent jailbreak framework that generalizes across LLMs with varying safety measures. Using reinforcement learning, MetaCipher is modular and adaptive, supporting extensibility to future strategies. Within as few as 10 queries, MetaCipher achieves state-of-the-art attack success rates on recent malicious prompt benchmarks, outperforming prior jailbreak methods. We conduct a large-scale empirical evaluation across diverse victim models and benchmarks, demonstrating its robustness and adaptability. Warning: This paper contains model outputs that may be offensive or harmful, shown solely to demonstrate jailbreak efficacy.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 26 of its 44 references that are in the map. First posted on arXiv 27 Jun 2025.

Builds on

26 of 44 references.

References · 26

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  7. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  9. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  10. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 398
  11. 2024PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preferencecited by 261
  12. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 199
14 more
  1. 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 155
  2. 2024Non-Determinism of "Deterministic" LLM Settingscited by 92
  3. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuningcited by 67
  4. 2024When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Searchcited by 47
  5. 2024Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characterscited by 42
  6. 2024Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?cited by 34
  7. 2025Llama-3.1-FoundationAI-SecurityLLM-Base-8B Technical Reportcited by 31
  8. 2024Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detectioncited by 23
  9. 2025Understanding and Enhancing the Transferability of Jailbreaking Attackscited by 22
  10. 2025LLMs Provide Unstable Answers to Legal Questionscited by 19
  11. 2025Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactionscited by 15
  12. 2025One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMscited by 12
  13. 2025PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Samplingcited by 6
  14. 2024Kov: Transferable and Naturalistic Black-Box LLM Attacks using Markov Decision Processes and Tree Searchcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026HarmChip: Evaluating Hardware Security Centric LLM Safety via Jailbreak Benchmarkingcited by 3
  2. 2026Evolving Skill-Structured Attack Memory Enhances LLM Jailbreakingcited by 3
  3. 2026Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuningcited by 0
  4. 2026To Cache or Not to Cache: Understanding and Mitigating Safety Incompatibility in Cross-Model KV Cache Reusecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approach
  2. 2025Evaluating Multi-Agent Defences Against Jailbreaking Attacks on Large Language Models
  3. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem
  4. 2025Formalization Driven LLM Prompt Jailbreaking via Reinforcement Learning
  5. 2026A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks
  6. 2025Defending Large Language Models Against Jailbreak Exploits with Responsible AI Considerations
  7. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks
  8. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing