mlsanityData to 14 Oct 2026

Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning

arXiv 2609.09553 ↗First posted 9 Sep 2026cs.CR cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large language model safety and security research is preoccupied with, among other things, detecting and preventing jailbreak attacks: alignment bypasses that allow an adversarial user to elicit unwanted or harmful outputs from models. Arbitrary cipher, or covert communication, attacks are one such type of jailbreak and have previously been demonstrated against the fine-tuning APIs of commercial models. In these attacks, target models are trained on a corpus of encrypted harmful questions and responses and subsequently respond to harmful requests through the learned encryption scheme. In this paper, we show that newer frontier models do not require fine-tuning to acquire cipher-based communication skills. Instead, they can learn these skills through prompting and, when necessary, through in-context learning. Furthermore, model alignment is significantly weakened or entirely bypassed when communication occurs through the learned cipher. To the best of our knowledge, this constitutes a novel attack vector against commercial black-box large language models. We demonstrate successful jailbreaks against frontier models developed by Anthropic, Google, and OpenAI. Our attack bypasses commercial harmfulness classifiers because harmful content is encrypted and therefore appears as nonsensical text or gibberish.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 49 of its 60 references that are in the map. First posted on arXiv 9 Sep 2026.

Builds on

49 of 60 references.

Closest ancestors · 23

Same direction, newest first

  1. 2026Boundary Point Jailbreaking of Black-Box LLMs16 Feb
  2. 2026Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks8 Jan
  3. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections10 Oct
  4. 2025MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs27 Jun
  5. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming31 Jan
  6. 2025Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface16 Jan
  7. 2024Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models11 Dec
  8. 2024PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMs23 Sep
  9. 2024Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization15 May
  10. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  11. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models21 Feb
  12. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
11 more
  1. 2024A Cross-Language Investigation into Jailbreak Attacks in Large Language Models30 Jan
  2. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  4. 2023Multilingual Jailbreak Challenges in Large Language Models10 Oct
  5. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  6. 2023Low-Resource Languages Jailbreak GPT-43 Oct
  7. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  8. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  9. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  11. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 26

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  3. 2017Deep reinforcement learning from human preferencescited by 3,912
  4. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  5. 2019Fine-Tuning Language Models from Human Preferencescited by 2,150
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  7. 2022Red Teaming Language Models with Language Modelscited by 1,026
  8. 2023Progress measures for grokking via mechanistic interpretabilitycited by 839
  9. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 729
  10. 2020Aligning AI With Shared Human Valuescited by 723
  11. 2025LLMs Get Lost In Multi-Turn Conversationcited by 429
  12. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
14 more
  1. 2023Removing RLHF Protections in GPT-4 via Fine-Tuningcited by 171
  2. 2025AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challengescited by 169
  3. 2023The Learnability of In-Context Learningcited by 127
  4. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 80
  5. 2024From Tokens to Words: On the Inner Lexicon of LLMscited by 48
  6. 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agentscited by 42
  7. 2024Long Context Alignment with Short Instructions and Synthesized Positionscited by 22
  8. 2026International AI Safety Report 2026cited by 22
  9. 2024PROMPTFUZZ: Harnessing Fuzzing Techniques for Robust Testing of Prompt Injection in LLMscited by 17
  10. 2025Understanding LLM Behaviors via Compression: Data Generation, Knowledge Acquisition and Scaling Lawscited by 15
  11. 2024FineTuneBench: How well do commercial fine-tuning APIs infuse knowledge into LLMs?cited by 12
  12. 2024On the Loss of Context-awareness in General Instruction Fine-tuningcited by 11
  13. 2025Towards Safeguarding LLM Fine-tuning APIs against Cipher Attackscited by 11
  14. 2025Enhancing LLM Knowledge Learning through Generalizationcited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  2. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks
  3. 2024Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring
  4. 2024Jailbreaking Large Language Models Through Alignment Vulnerabilities in Out-of-Distribution Settings
  5. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
  6. 2024Weak-to-Strong Jailbreaking on Large Language Models
  7. 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probing
  8. 2025Evaluating Adversarial Vulnerabilities in Modern Large Language Models