mlsanityData to 14 Oct 2026

LLM-Agnostic Semantic Representation Attack

arXiv 2605.08898 ↗First posted 9 May 2026cs.CL cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs) increasingly employ alignment techniques to prevent harmful outputs. Despite these safeguards, attackers can circumvent them by crafting adversarial prompts. Predominant token-level optimization methods primarily rely on optimizing for exact affirmative templates (e.g., ``textitSure, here is...''). However, these paradigms frequently encounter bottlenecks such as suboptimal convergence, compromised prompt naturalness, and poor cross-model generalization. To address these limitations, we propose Semantic Representation Attack (SRA), a novel LLM-agnostic paradigm that fundamentally reconceptualizes adversarial objectives from exact textual targeting to malicious semantic representations. Theoretically, we establish the semantic Coherence-Convergence Relationship and derive a Cross-Model Semantic Generalization bound, proving that maintaining semantic coherence guarantees both white-box semantic convergence and black-box transferability. Technically, we operationalize this framework via the Semantic Representation Heuristic Search (SRHS) algorithm, which preserves interpretability and structural coherence of the adversarial prompts during incremental discrete token chunk expansion. Extensive evaluations demonstrate that our framework achieves a 99.71% average attack success rate across 26 open-source LLMs, with strong transferability and stealth.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 62 of its 82 references that are in the map. First posted on arXiv 9 May 2026.

Builds on

62 of 82 references.

Closest ancestors · 17

Same direction, newest first

  1. 2026Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search26 Feb
  2. 2025Semantic Representation Attack against Aligned Large Language Models18 Sep
  3. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  5. 2024Fast Adversarial Attacks on Language Models In One GPU Minute23 Feb
  6. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  7. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  9. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models23 Oct
  10. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks16 Oct
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  12. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
5 more
  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  2. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  3. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  5. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 45

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2025Qwen3 Technical Reportcited by 8,820
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2013Intriguing properties of neural networkscited by 5,155
  10. 2017Deep reinforcement learning from human preferencescited by 3,912
  11. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  12. 2023Qwen Technical Reportcited by 3,344
33 more
  1. 2022Scaling Instruction-Finetuned Language Modelscited by 3,024
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  3. 2022Large Language Models Encode Clinical Knowledgecited by 1,830
  4. 2016Adversarial examples in the physical worldcited by 1,769
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  6. 2022Red Teaming Language Models with Language Modelscited by 1,026
  7. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  8. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  9. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  10. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
  11. 2023Baichuan 2: Open Large-scale Language Modelscited by 670
  12. 2023Zephyr: Direct Distillation of LM Alignmentcited by 506
  13. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 336
  14. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  15. 2023Are aligned neural networks adversarially aligned?cited by 315
  16. 2023LMDrive: Closed-Loop End-to-End Driving with Large Language Modelscited by 305
  17. 2023A Survey on Multimodal Large Language Models for Autonomous Drivingcited by 290
  18. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  19. 2023OpenChat: Advancing Open-source Language Models with Mixed-Quality Datacited by 252
  20. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 234
  21. 2023SOLAR 10.7B: Scaling Large Language Models with Simple yet Effective Depth Up-Scalingcited by 172
  22. 2023Orca 2: Teaching Small Language Models How to Reasoncited by 159
  23. 2023Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Modelscited by 138
  24. 2023Language Models Meet World Models: Embodied Experiences Enhance Language Modelscited by 124
  25. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
  26. 2023Large Language Models as Generalizable Policies for Embodied Taskscited by 86
  27. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 79
  28. 2020Semantic Equivalent Adversarial Data Augmentation for Visual Question Answeringcited by 26
  29. 2023Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical Worldcited by 21
  30. 2023BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attackscited by 21
  31. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  32. 2024Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts?cited by 15
  33. 2023CBA: Contextual Background Attack against Optical Aerial Detection in the Physical Worldcited by 7

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Adversarial Tokenization
  2. 2024Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Models
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models
  4. 2025Selective Adversarial Attacks on LLM Benchmarks
  5. 2026Disentangling Adversarial Prompts: A Semantic-Graph Defense for Robust LLM Security
  6. 2025Attack and defense techniques in large language models: A survey and new perspectives
  7. 2026One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs
  8. 2024Exploiting LLM Quantization