ICO: Enhancing semantic-shift jailbreak attacks through iterative context optimization

The researchers propose ICO, a black-box semantic-shift jailbreak framework, which achieves an average attack success rate of 74.6% across 3 datasets and 8 target foundation models, outperforming 8 state-of-the-art baselines. Semantic-shift jailbreaking replaces harmful words in a harmful question with benign substitutes, then uses context to induce the model to reinterpret these substitutes as the corresponding harmful concepts. The paper finds that the limited effectiveness of existing methods stems from neglecting the semantic-shift capability of the context itself; different contexts differ markedly in their ability to induce semantic shifts, and the stronger the capability, the easier it is to guide the model to recover the harmful meaning and successfully jailbreak. In each iteration, ICO uses distilled effective context features and feedback from the target model to optimize the context.