SpatialJB: How Text Distribution Art Becomes the "Jailbreak Key" for LLM Guardrails
College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；The University of Sydney（悉尼大学）；The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, Zhejiang University（浙江大学杭州高科技园区（滨江）区块链与数据安全研究所）；Zhejiang Key Laboratory of Intelligent Education Technology and Application, Zhejiang Normal University（浙江师范大学浙江省智能教育技术与应用重点实验室）；Sun Yat-sen University（中山大学）；Hong Kong Polytechnic University（香港理工大学）
Zhiyi Mou, Jingyuan Yang, Zeheng Qian, Wangze Ni, Tianfang Xiao, Ning Liu, Chen Zhang, Zhan Qin, Kui Ren
While Large Language Models (LLMs) have powerful capabilities, they remain vulnerable to jailbreak attacks, which is a critical barrier to their safe web real-time application. Current commercial LLM providers deploy output guardrails to filter harmful outputs, yet these defenses are not impenetrable. Due to LLMs' reliance on autoregressive, token-by-token inference, their semantic representations lack robustness to spatially structured perturbations, such as redistributing tokens across different rows, columns, or diagonals. Exploiting the Transformer's spatial weakness, we propose SpatialJB to disrupt the model's output generation process, allowing harmful content to bypass guardrails without detection. Comprehensive experiments conducted on leading LLMs get nearly 100% ASR, demonstrating the high effectiveness of SpatialJB. Even after adding advanced output guardrails, like the OpenAI Moderation API, SpatialJB consistently maintains a success rate exceeding 75%, outperforming current jailbreak techniques by a significant margin. The proposal of SpatialJB exposes a key weakness in current guardrails and emphasizes the importance of spatial semantics, offering new insights to advance LLM safety research. To prevent potential misuse, we also present baseline defense strategies against SpatialJB and evaluate their effectiveness in mitigating such attacks. The code for the attack, baseline defenses, and a demo are available at https://anonymous.4open.science/r/SpatialJailbreak-8E63.
DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection
The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全全国重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新技术开发区（滨江）区块链与数据安全研究所）；Shanghai AI Laboratory（上海人工智能实验室）；East China Normal University（华东师范大学）
HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
Pohang University of Science and Technology (POSTECH)（浦项科技大学）；Inha University（仁荷大学）；Daegu Gyeongbuk Institute of Science and Technology (DGIST)（大邱庆北科学技术院）
DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization
State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China（区块链与数据安全国家重点实验室，浙江大学，杭州，中国）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, Hangzhou, China（杭州高新技术区（滨江）区块链与数据安全研究院，杭州，中国）
The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search
Georgia Institute of Technology（佐治亚理工学院）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Tsinghua University（清华大学）；University of California San Diego（加利福尼亚大学圣迭戈分校）；National Taiwan University（台湾大学）；IBM Research（IBM研究院）
ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models
Beijing University of Posts and Telecommunications（北京邮电大学）；National University of Singapore（新加坡国立大学）；CSIRO’s Data61（CSIRO数据61）；Responsible AI Research (RAIR) Centre, The University of Adelaide（负责任人工智能研究（RAIR）中心，阿德莱德大学）；Tsinghua University（清华大学）
Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection
Pedeciba Informática（Pedeciba信息学研究所）；InCo, Facultad de Ingeniería, Universidad de la República（共和国大学工程学院计算研究所）；Departamento de Informática e Inteligencia Artificial, Universidad Católica del Uruguay（乌拉圭天主教大学信息与人工智能系）
Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics
Huazhong University of Science and Technology（华中科技大学）；Changsha University of Science and Technology（长沙理工大学）；Xiangtan University（湘潭大学）；City University of Macau（澳门城市大学）；Griffith University（格里菲斯大学）
Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks
University of California, Berkeley（加州大学伯克利分校）；Stanford University（斯坦福大学）；Georgia Institute of Technology（佐治亚理工学院）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；McGill University（麦吉尔大学）；Mila（米拉研究所）
EVA: Editing for Versatile Alignment against Jailbreaks
ShanghaiTech University（上海科技大学）；Sun Yat-sen University（中山大学）；State Key Laboratory of Blockchain and Data Security（区块链与数据安全国家重点实验室）；Tsinghua University（清华大学）
Engineering Programme, NUS Graduate School, National University of Singapore（国立新加坡大学整合科学与工程计划）；Institute of Data Science (IDS), National University of Singapore（国立新加坡大学数据科学研究所）；Department of Computer Science, School of Computing, National University of Singapore（国立新加坡大学计算机科学系）
