mlsanityData to 14 Oct 2026

Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Is

arXiv 2507.21820 ↗First posted 29 Jul 2025cs.CVcited by 7

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Despite significant advancements in alignment and content moderation, large language models (LLMs) and text-to-image (T2I) systems remain vulnerable to prompt-based attacks known as jailbreaks. Unlike traditional adversarial examples requiring expert knowledge, many of today's jailbreaks are low-effort, high-impact crafted by everyday users with nothing more than cleverly worded prompts. This paper presents a systems-style investigation into how non-experts reliably circumvent safety mechanisms through techniques such as multi-turn narrative escalation, lexical camouflage, implication chaining, fictional impersonation, and subtle semantic edits. We propose a unified taxonomy of prompt-level jailbreak strategies spanning both text-output and T2I models, grounded in empirical case studies across popular APIs. Our analysis reveals that every stage of the moderation pipeline, from input filtering to output validation, can be bypassed with accessible strategies. We conclude by highlighting the urgent need for context-aware defenses that reflect the ease with which these jailbreaks can be reproduced in real-world settings.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 22 of its 50 references that are in the map. First posted on arXiv 29 Jul 2025.

Builds on

22 of 50 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Ciphers22 May
  2. 2025QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language13 Feb
  3. 2024RoleBreak: Character Hallucination as a Jailbreak Attack in Role-Playing Systems25 Sep
  4. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles8 Aug
  5. 2024WordGame: Efficient & Effective LLM Jailbreak via Simultaneous Obfuscation in Query and Response22 May
  6. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  7. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  8. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation6 Nov
  9. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
  10. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study23 May

Other references · 12

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  2. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  3. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 365
  4. 2023Toxicity in ChatGPT: Analyzing Persona-assigned Language Modelscited by 360
  5. 2022Red-Teaming the Stable Diffusion Safety Filtercited by 264
  6. 2024Two Tales of Persona in LLMs: A Survey of Role-Playing and Personalizationcited by 208
  7. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 189
  8. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 102
  9. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 72
  10. 2024Current state of LLM Risks and AI Guardrailscited by 46
  11. 2024Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Stepcited by 11
  12. 2024Are Large Language Models Really Bias-Free? Jailbreak Prompts for Assessing Adversarial Robustness to Bias Elicitationcited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 7.

7 papers.

  1. 2026Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filterscited by 5
  2. 2026An Empirical Study of Multi-Generation Sampling for Jailbreak Detection in Large Language Modelscited by 2
  3. 2026Into the Gray Zone: Domain Contexts Can Blur LLM Safety Boundariescited by 1
  4. 2026How Does Prefix Matter in Reasoning Model Tuning?cited by 0
  5. 2026In Vino Veritas and Vulnerabilities: Examining LLM Safety via Drunk Language Inducementcited by 0
  6. 2026Compression as an Adversarial Amplifier Through Decision Space Reductioncited by 0
  7. 2026Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signalscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  2. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models
  3. 2025Behind the Mask: Benchmarking Camouflaged Jailbreaks in Large Language Models
  4. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
  5. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily
  6. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
  7. 2025Jailbreak Mimicry: Automated Discovery of Narrative-Based Jailbreaks for Large Language Models
  8. 2024AutoBreach: Universal and Adaptive Jailbreaking with Efficient Wordplay-Guided Optimization