AttacksarXiv 2609.39902Sep 30
CodeMimicry: Exploiting code-domain safety generalization lag for structured code completion jailbreaks.
提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
arXiv
2609.39902
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-4.1, GPT-5-chat and others10
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
AttacksarXiv 2609.09553Sep 9
研究：任意密文攻击前沿大模型无需微调即可越狱
提出任意字母置换密码越狱，无需微调即可诱导有害输出
arXiv
2609.09553
Published
Sep 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
AttacksarXiv 2607.27373Jul 30
RoguePrompt 用双层编码绕过 LLM 审核
提出 RoguePrompt 双层编码自重构越狱，绕过 LLM 审核
arXiv
2607.27373
Published
Jul 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
OpenAI GPT-4o (gpt-4o-2024-11-20), Anthropic Claude 3 Opus (claude-3-opus-20240229), Google Gemini 1.5 Pro (gemini-1.5-pro-002)
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2606.21077Jun 19
OTTER：仅替换五个 token 即可绕过 GPT 系列毒性审核
提出 OTTER 词元替换越狱，绕过表面毒性审核诱导有害回答
arXiv
2606.21077
Published
Jun 19
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gpt-4-turbo, gpt-4o, gpt-4o-mini and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文展示了表面毒性与恶意意图的解耦现象，通过标准 API 实现黑盒越狱测试，并提出闭环分类器加固建议。
Paper analysisRead analysis
AttacksarXiv 2606.11425Jun 10
JailbreakOPT：工具辅助的迭代越狱提示词优化框架
提出 JailbreakOPT，组合原子工具迭代优化黑盒单轮越狱提示
arXiv
2606.11425
Published
Jun 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Vicuna-13b-v1.5, LLaMA-3-8b, GPT-4o and others8
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2606.01837Jun 1
论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
arXiv
2606.01837
Published
Jun 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。
DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
Paper analysisRead analysis
AttacksarXiv 2605.17971May 18
Babel 利用混淆分布采样越狱 LLM 安全注意力
提出 Babel 混淆分布采样，黑盒越狱闭源 LLM 安全注意力
arXiv
2605.17971
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gpt-4o-2024-11-20, Gemini-2.0-flash, Claude-3-5-haiku-20241120 and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2605.18915May 18
DMN：面向多图输入的多模态大模型组合式越狱框架
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
arXiv
2605.18915
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4V, GPT-4o, GPT-5 and others10
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.05709May 7
研究者提出利用重构与隐藏权衡的多模态大模型越狱方法
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
arXiv
2605.05709
Published
May 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.4-nano, GPT-5.4-mini, Gemini-2.5-Flash and others19
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.03441May 5
研究用数学编码绕过 LLM 安全过滤
提出 Formal Logic 等数学编码越狱，绕过自然语言安全过滤
arXiv
2605.03441
Published
May 5
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o-Mini, GPT-5-Mini, GPT-5 and others8
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract作者比较六种数学编码，称深度改写而非数学符号本身更能绕过现有安全过滤。
作者在 black-box、只提交纯文本的设定下，比较六种数学编码能否让仍开着安全措施的模型产出有害内容。
Paper analysisRead analysis
AttacksarXiv 2603.16192Mar 17
针对大语言模型越狱攻击的结构化语义遮蔽
提出 S2C 越狱，用情境改写、切分和线索伪装推迟有害意图整合
arXiv
2603.16192
Published
Mar 17
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.3-70B-Instruct, DeepSeek-r1, DeepSeek-v3 and others16
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2603.07590Mar 8
模型作为乐高搭建者：用语义蓝图从无害积木拼装恶意
提出 StructAttack，用结构图把无害语义槽诱导视觉模型拼成恶意内容
arXiv
2603.07590
Published
Mar 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash and others6
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractStructAttack 把有害查询拆成无害槽并画进结构图，在黑盒单次查询下诱导 LVLM 填出有害内容。
StructAttack 是针对 LVLM 的黑盒、单次查询越狱：把有害指令拆成单独看似无害的槽，画进结构图，再让模型把槽拼回有害内容。。
Paper analysisRead analysis
AttacksarXiv 2603.07028Mar 7
两帧即可：针对文本到视频模型越狱的时序攻击
提出 TFM，用起止帧与隐式替换越狱文生视频模型
arXiv
2603.07028
Published
Mar 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Pixverse V5, Hailuo 02, Kling 2.1 Master and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
AbstractTFM 先抽起止帧再做隐式替换。
TFM 是面向文生视频的严格黑盒提示越狱，利用模型对未写明中间过程的时间补全。
Paper analysisRead analysis
AttacksarXiv 2602.22983Feb 26
隐晦却有效：基于仿生搜索的文言文越狱提示词优化
提出 CC-BOS，在八维策略空间用果蝇搜索优化文言文越狱提示
arXiv
2602.22983
Published
Feb 26
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini-2.5-flash, Claude-3-7-sonnet-20250219, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2602.10148Feb 10
Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models
提出 COMET 跨模态纠缠攻击，越狱视觉语言模型
arXiv
2602.10148
Published
Feb 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4.1, GPT-4.1-mini, Gemini-2.5-Flash and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractCOMET 做黑盒跨模态纠缠越狱。
COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。
Paper analysisRead analysis
AttacksarXiv 2602.00420Jan 31
研究者提出 Text-DJ，利用 OCR 能力越狱大型视觉语言模型
提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
arXiv
2602.00420
Published
Jan 31
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen/Qwen3-VL-4B-Instruct, Qwen/Qwen3-VL-8B-Instruct, Qwen/Qwen3-VL-30B-A3B-Instruct and others6
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2601.07141Jan 12
MacPrompt：面向文本到图像模型的混合语言引导越狱攻击
提出 MacPrompt 跨语言字符重组越狱，绕过文生图模型的过滤与概念移除
arXiv
2601.07141
Published
Jan 12
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
SD v2.1, ESD, SLD (Max) and others14
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2601.05150Jan 9
PC²: Generating Politically Controversial Content via Jailbreak Attacks on GPT-Based Text-to-Image Models
提出 PC² 越狱，用身份保持描述与远端多语翻译绕过文生图过滤
arXiv
2601.05150
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-5, GPT-5.1 and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop