mlsanityData to 7 Oct 2026

LatentBreak: Jailbreaking Large Language Models through Latent Space Feedback

arXiv 2510.08604 ↗First posted 7 Oct 2025cs.CL cs.AI cs.LGcited by 2

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Jailbreaks are adversarial attacks designed to bypass the built-in safety mechanisms of large language models. Automated jailbreaks typically optimize an adversarial suffix or adapt long prompt templates by forcing the model to generate the initial part of a restricted or harmful response. In this work, we show that existing jailbreak attacks that leverage such mechanisms to unlock the model response can be detected by a straightforward perplexity-based filtering on the input prompt. To overcome this issue, we propose LatentBreak, a white-box jailbreak attack that generates natural adversarial prompts with low perplexity capable of evading such defenses. LatentBreak substitutes words in the input prompt with semantically-equivalent ones, preserving the initial intent of the prompt, instead of adding high-perplexity adversarial suffixes or long templates. These words are chosen by minimizing the distance in the latent space between the representation of the adversarial prompt and that of harmless requests. Our extensive evaluation shows that LatentBreak leads to shorter and low-perplexity prompts, thus outperforming competing jailbreak algorithms against perplexity-based filters on multiple safety-aligned models.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 17 of its 21 references that are in the map. First posted on arXiv 7 Oct 2025.

Builds on

17 of 21 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep

Other references · 15

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  3. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  4. 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 825
  5. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  6. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  7. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  8. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  9. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  10. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  11. 2023Detecting Language Model Attacks with Perplexitycited by 411
  12. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
3 more
  1. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  2. 2024Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspectivecited by 44
  3. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Modelscited by 34

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detectioncited by 4
  2. 2026Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Models
  2. 2024Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation
  3. 2025Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs
  4. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  5. 2025LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs
  6. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  7. 2024Defending against Jailbreak through Early Exit Generation of Large Language Models
  8. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models