mlsanityData to 14 Oct 2026

PUZZLED: Jailbreaking LLMs through Word-Based Puzzles

arXiv 2508.01306 ↗First posted 2 Aug 2025cs.AI cs.CRcited by 2

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

As large language models (LLMs) are increasingly deployed across diverse domains, ensuring their safety has become a critical concern. In response, studies on jailbreak attacks have been actively growing. Existing approaches typically rely on iterative prompt engineering or semantic transformations of harmful instructions to evade detection. In this work, we introduce PUZZLED, a novel jailbreak method that leverages the LLM's reasoning capabilities. It masks keywords in a harmful instruction and presents them as word puzzles for the LLM to solve. We design three puzzle types-word search, anagram, and crossword-that are familiar to humans but cognitively demanding for LLMs. The model must solve the puzzle to uncover the masked words and then proceed to generate responses to the reconstructed harmful instruction. We evaluate PUZZLED on five state-of-the-art LLMs and observe a high average attack success rate (ASR) of 88.8%, specifically 96.5% on GPT-4.1 and 92.3% on Claude 3.7 Sonnet. PUZZLED is a simple yet powerful attack that transforms familiar puzzles into an effective jailbreak strategy by harnessing LLMs' reasoning capabilities.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 10 of its 14 references that are in the map. First posted on arXiv 2 Aug 2025.

Builds on

10 of 14 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024SATA: A Paradigm for LLM Jailbreak via Simple Assistive Task Linkage19 Dec
  2. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing28 May
  3. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  4. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  5. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 4

  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  2. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
  3. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  4. 2023RAIN: Your Language Models Can Align Themselves without Finetuningcited by 157

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Jailbreak Foundry: From Papers to Runnable Attacks for Reproducible Benchmarkingcited by 2
  2. 2026Structured Semantic Cloaking for Jailbreak Attacks on Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024WordGame: Efficient & Effective LLM Jailbreak via Simultaneous Obfuscation in Query and Response
  2. 2025Exploring Jailbreak Attacks on LLMs through Intent Concealment and Diversion
  3. 2024Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models
  4. 2023Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks
  5. 2024AutoBreach: Universal and Adaptive Jailbreaking with Efficient Wordplay-Guided Optimization
  6. 2026Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Prompting
  7. 2025Formalization Driven LLM Prompt Jailbreaking via Reinforcement Learning
  8. 2024Play Guessing Game with LLM: Indirect Jailbreak Attack with Implicit Clues