Furina: Fragmented Uncertainty-Driven Refusal Instability Attack
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
Safety alignment in large language models (LLMs) and multimodal large language models (MLLMs) is commonly assumed to operate as a near-binary threshold mechanism. We challenge this assumption by revealing that safety behavior is governed by an instability region where small perturbations induce stochastic refusal decisions rather than deterministic outcomes. We develop a multi-metric diagnostic framework combining external and internal signals to characterize this instability. Through systematic experiments, we identify a characteristic diagnostic signature: inputs in unstable regimes exhibit elevated output uncertainty yet decreased internal safety activation, a decoupling phenomenon that explains why detection-based defenses fail against sophisticated attacks. Building on this framework, we introduce Furina, a jailbreak attack that deliberately induces this signature through fragmented, scene-anchored prompts without model-specific optimization. Furina outperforms strong single-turn and multi-turn baselines on HarmBench and achieves competitive results on MM-SafetyBench, demonstrating that uncertainty amplification provides a principled and transferable mechanism for understanding safety vulnerabilities. Code is available at: https://github.com/0xCavaliers/Furina_Jailbreak.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 34 of its 55 references that are in the map. First posted on arXiv 24 May 2026.
Builds on
34 of 55 references.
Closest ancestors · 6
Same direction, newest first
- 2025How Semantically Stable Are LLM Refusals? Measuring Confusion in Local Safety Boundaries30 Nov
- 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy26 Mar
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
- 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
- 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
Other references · 28
- 2024GPT-4o System Cardcited by 4,467
- 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,290
- 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,655
- 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,582
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
- 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 877
- 2023Semantic Uncertainty: Linguistic Invariances for Uncertainty Estimation in Natural Language Generationcited by 795
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
- 2023Detecting Language Model Attacks with Perplexitycited by 411
16 more
- 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
- 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 255
- 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 185
- 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMscited by 160
- 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
- 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 70
- 2024White-box Multimodal Jailbreaks Against Large Vision-Language Modelscited by 57
- 2025A Survey of Uncertainty Estimation Methods on Large Language Modelscited by 57
- 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 53
- 2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Modelscited by 27
- 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreakingcited by 22
- 2024Exploring Response Uncertainty in MLLMs: An Empirical Evaluation under Misleading Scenarioscited by 19
- 2025A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreakscited by 10
- 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steeringcited by 10
- 2025JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Modelscited by 8
- 2025Jailbreak Transferability Emerges from Shared Representationscited by 5
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
- 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probing
- 2026Fail-Closed Alignment for Large Language Models
- 2025Improving LLM Safety Alignment with Dual-Objective Optimization
- 2025Differentiated Directional Intervention A Framework for Evading LLM Safety Alignment
- 2026When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning
- 2026When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs
- 2026HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment