DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLMs Jailbreakers (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing jailbreaking methods view a malicious prompt as a whole but they are not effective at reducing LLMs’ attention on combinations of words with malice. |
| Approach: | They propose an automatic prompt Decomposition and Reconstruction framework for jailbreaking Attack that decomposes a malicious prompt into separate sub-prompts and reassembles them implicitly by In-Context Learning. |
| Outcome: | The proposed framework reduces LLMs' attention on malice words by presenting them to LLM in a fragmented form, addressing these limitations and improving attack effectiveness. |
Similar Papers
RePD: Defending Jailbreak Attack through a Retrieval-based Prompt Decomposition Process (2025.findings-naacl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are still susceptible to jailbreak exploits despite rigorous pre-training and fine-tuning focused on ethical alignment . |
| Approach: | They propose a Retrieval-based attack Retriest-based Prompt Decomposition framework that decomposes harmful queries embedded within user prompts into a one-shot learning example to effectively teach the LLM to discern and separate malicious components. |
| Outcome: | The proposed framework is capable of decomposing harmful queries from the original query and enhancing the resilience of large language models against jailbreak attacks without compromising their performance. |
BaitAttack: Alleviating Intention Shift in Jailbreak Attacks via Adaptive Bait Crafting (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing attacks focus on meticulously constructing prompts to disguise harmful intentions . however, incorporation of disguising prompts may incur the challenge of "intention shift" |
| Approach: | They propose a jailbreak attack component, BaitAttack, to alleviate the effects of intention shift . Bait provides a response to the query, prompting LLMs to rectify or supplement the knowledge within the bait . |
| Outcome: | The proposed component, BaitAttack, reduces the effects of intention shift within jailbreak attacks. |
Harmful Prompt Laundering: Jailbreaking LLMs with Abductive Styles and Symbolic Encoding (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated remarkable capabilities but their misuse for harmful purposes remains a concern. |
| Approach: | They propose a jailbreaking technique that exploits weaknesses in LLMs' architecture . they propose abductive framing and symbolic encoding to bypass safeguards . |
| Outcome: | The proposed technique achieves over 95% attack success rate on GPT-series models and 70% across all targets. |
Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) are susceptible to a type of attack known as jailbreaking, which misleads LLMs to output harmful contents. |
| Approach: | They propose to leverage hidden representations into existing jailbreak targets to move the attacks along the acceptance direction. |
| Outcome: | The proposed methods are validated using the objective of existing jailbreak attacks. |
DiffusionAttacker: Diffusion-Driven Prompt Manipulation for LLM Jailbreak (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are susceptible to generating harmful content when prompted with carefully crafted inputs, a vulnerability known as LLM jailbreaking. |
| Approach: | They propose an end-to-end generative approach for jailbreak rewriting inspired by diffusion models that uses a sequence-tosequence (seq2sequ) diffusion model as a generator, conditioning on the original prompt and guiding the denoising process with a novel attack loss. |
| Outcome: | Experiments on Advbench and Harmbench show that the proposed method outperforms autoregressive jailbreak models across evaluation metrics including ASR, fluency, diversity and diversity. |
A Wolf in Sheep’s Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing methods for generating 'jailbreaks' suffer from manual design or require optimization on other white-box models, which compromises either generalization or efficiency. |
| Approach: | They propose a framework that leverages LLMs to generate effective jailbreak prompts and a generalized framework that can be used to generate prompts. |
| Outcome: | The proposed framework improves the attack success rate while reducing the time cost compared to baselines. |
Defensive Prompt Patch: A Robust and Generalizable Defense of Large Language Models against Jailbreak Attacks (2025.findings-acl)
Copied to clipboard
| Challenge: | Recent advances in large language models (LLMs) have showcased their ability to understand and generate text akin to human interaction. |
| Approach: | They propose a prompt-based defense mechanism specifically designed to protect LLMs against jailbreak attacks by introducing jailbreak prompts into malicious queries. |
| Outcome: | Empirical results show that the proposed defense outperforms existing defense strategies in balancing safety and utility while maintaining high utility. |
Defending LLMs against Jailbreaking Attacks via Backtranslation (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent advancement in large language models (LLMs) has shown their extensive applications and transformative potential to reshape people's lives. |
| Approach: | They propose a method which uses backtranslation to infer an input prompt from an input input prompt and then run it again on the backtranslated prompt. |
| Outcome: | The proposed method outperforms baselines and has little impact on the generation quality for benign input prompts. |
MultiCodeAttack: Iterative Jailbreak Attacking on LLMs with Multi-Code Prompt Injection (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to jailbreak rely on fixed template design and a single programming language . however, existing approaches do not consider language diversity or adaptive template evolution . |
| Approach: | They propose a structured jailbreak framework that explores and optimizes multi-language code templates. |
| Outcome: | The proposed framework outperforms existing jailbreak baselines and produces higher harmful outputs than baseline methods. |
SequentialBreak: Large Language Models Can be Fooled by Embedding Jailbreak Prompts into Sequential Prompt Chains (2025.acl-srw)
Copied to clipboard
| Challenge: | SequentialBreak enables LLMs to bypass safety mechanisms by arranging malicious prompts in a single query. |
| Approach: | They propose a single-query jailbreak technique that arranges multiple benign prompts in sequence with a hidden malicious instruction among them to bypass safety mechanisms. |
| Outcome: | The proposed technique outperforms baselines on open-source and closed-source models. |