mlsanityData to 14 Oct 2026

Safe2Harm: Semantic Isomorphism Attacks for Jailbreaking Large Language Models

arXiv 2512.13703 ↗First posted 5 Dec 2025cs.CR cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs) have demonstrated exceptional performance across various tasks, but their security vulnerabilities can be exploited by attackers to generate harmful content, causing adverse impacts across various societal domains. Most existing jailbreak methods revolve around Prompt Engineering or adversarial optimization, yet we identify a previously overlooked phenomenon: many harmful scenarios are highly consistent with legitimate ones in terms of underlying principles. Based on this finding, this paper proposes the Safe2Harm Semantic Isomorphism Attack method, which achieves efficient jailbreaking through four stages: first, rewrite the harmful question into a semantically safe question with similar underlying principles; second, extract the thematic mapping relationship between the two; third, let the LLM generate a detailed response targeting the safe question; finally, reversely rewrite the safe response based on the thematic mapping relationship to obtain harmful output. Experiments on 7 mainstream LLMs and three types of benchmark datasets show that Safe2Harm exhibits strong jailbreaking capability, and its overall performance is superior to existing methods. Additionally, we construct a challenging harmful content evaluation dataset containing 358 samples and evaluate the effectiveness of existing harmful detection methods, which can be deployed for LLM input-output filtering to enable defense.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 25 of its 39 references that are in the map. First posted on arXiv 5 Dec 2025.

Builds on

25 of 39 references.

Closest ancestors · 13

Same direction, newest first

  1. 2025Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency24 Oct
  2. 2025Adversarial Reasoning at Jailbreaking Time3 Feb
  3. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  4. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses3 Jun
  5. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  6. 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling2 Mar
  7. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  8. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  10. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  11. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  12. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
1 more
  1. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study23 May

Other references · 12

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2025Qwen3 Technical Reportcited by 8,820
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  5. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  6. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  7. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  8. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  10. 2021Recursively Summarizing Books with Human Feedbackcited by 290
  11. 2025Qwen3Guard Technical Reportcited by 155
  12. 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversationscited by 129

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  2. 2025SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks
  3. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models
  4. 2025Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers
  5. 2026SoK: Robustness in Large Language Models against Jailbreak Attacks
  6. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
  7. 2023Latent Jailbreak: A Benchmark for Evaluating Text Safety and Output Robustness of Large Language Models
  8. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks