FlipAttack: Jailbreaking Large Language Models by Flipping Text

The paper proposes FlipAttack, a jailbreak attack against black-box large language models that requires only a single query. Starting from the autoregressive property, the authors point out that LLMs tend to understand text from left to right, and that comprehension degrades when noise is added on the left; on this basis they use the prompt itself to construct left-side noise and extend it to 4 flip modes, then design 4 variants to guide the model to denoise, understand, and execute harmful behavior. Experiments on 8 LLMs show that the method reaches about 98% attack success rate on GPT-4o and an average bypass rate of about 98% against 5 guardrail models, and the code is open-sourced on GitHub.