OTTER: A Red-Teaming System for Toxicity-Evading Jailbreak Prompt Optimization
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
Production LLMs increasingly rely on toxicity-based moderation filters as a primary defense, assuming that harmful intent correlates with toxic surface wording. We show this assumption is fundamentally brittle: surface toxicity and adversarial intent can be decoupled by replacing as few as five tokens. We present OTTER (Obfuscated Toxicity-Evading Token Evolution for Rewriting), a black-box red-teaming framework requiring only standard API access, directly targeting the practical constraints of industry security audits. Evaluated on 457 AdvBench prompts across four GPT models, OTTER raises average ASR from 7.0% to 84.0%. We further provide the first quantitative analysis of the toxicity--bypass relationship and a per-category breakdown, translating our findings into actionable recommendations for classifier hardening in production deployments.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 8 of its 12 references that are in the map. First posted on arXiv 19 Jun 2026.
Builds on
8 of 12 references.
Closest ancestors · 5
Same direction, newest first
- 2024Diversity Helps Jailbreak Large Language Models6 Nov
- 2024Fast Adversarial Attacks on Language Models In One GPU Minute23 Feb
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
- 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
Other references · 3
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
- 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
Built on by
Not cited yet.