ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization

# ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
Source: [https://arxiv.org/html/2608.03210](https://arxiv.org/html/2608.03210)
Hujian Zhu1, Yihao Huang1, Felix Juefei\-Xu3, Xinfeng Li4, Peng Zeng1, Simeng Qin5, Qing Guo2, and Geguang Pu1

###### Abstract

Foundation models have achieved remarkable success across diverse tasks, but they remain vulnerable\. To investigate such vulnerabilities, semantic\-shift jailbreaks have recently emerged as a promising attack paradigm\. They bypass explicit safety mechanisms by replacing harmful terms in original harmful questions with benign alternatives and leveraging contextual information to induce the target model to reinterpret these alternatives as their corresponding harmful concepts\. However, existing semantic\-shift jailbreaks often achieve limited effectiveness\. In this work, we reveal that this limitation arises from overlooking the semantic\-shift capability of contexts\. Through systematic analysis, we find that contexts exhibit substantially different abilities in inducing semantic shifts: contexts with stronger semantic\-shift capabilities are more likely to guide models toward recovering harmful meanings and achieving successful jailbreaks\. Based on this finding, we systematically identify and distill the characteristics of effective contexts and propose a black\-box context\-aware semantic\-shift jailbreak framework with Iterative Context Optimization \(ICO\)\. In each iteration, ICO leverages these characteristics and feedback from the target model to optimize contexts\. Extensive experiments on three datasets and eight target foundation models demonstrate that ICO consistently outperforms eight state\-of\-the\-art baselines, achieving an average attack success rate of 74\.6%\.

###### Index Terms:

Foundation models, jailbreak attacks, semantic\-shift jailbreaks, iterative context optimization, model safety\.

## 1Introduction

![Refer to caption](https://arxiv.org/html/2608.03210v1/x1.png)Figure 1:Comparison of common jailbreaks, semantic\-shift jailbreaks, and ICO\.ICO achieves both surface\-benign inputs and high ASR through high\-quality contexts\.Large Language Models \(LLMs\) and Large Vision\-Language Models \(LVLMs\), collectively referred to as foundation models in this paper, have demonstrated remarkable capabilities in text understanding, reasoning, code generation, image perception, and multimodal interaction\[[5](https://arxiv.org/html/2608.03210#bib.bib1),[6](https://arxiv.org/html/2608.03210#bib.bib2),[1](https://arxiv.org/html/2608.03210#bib.bib3),[19](https://arxiv.org/html/2608.03210#bib.bib4),[17](https://arxiv.org/html/2608.03210#bib.bib5)\]\. They have been widely adopted for open\-ended question answering, content generation, and complex task execution\. However, foundation models suffer from safety risks\. Recent studies have revealed that they can be manipulated to generate unsafe content through carefully designed jailbreak inputs\[[30](https://arxiv.org/html/2608.03210#bib.bib6),[12](https://arxiv.org/html/2608.03210#bib.bib7),[33](https://arxiv.org/html/2608.03210#bib.bib8),[2](https://arxiv.org/html/2608.03210#bib.bib9),[11](https://arxiv.org/html/2608.03210#bib.bib10)\]\. Despite exposing these vulnerabilities, many existing jailbreak methods either explicitly include harmful concepts or rely on recognizable attack patterns, making them vulnerable to refusal mechanisms and input\-level safety defenses\.

To address this problem, recent studies have explored jailbreak methods that avoid directly using explicit harmful terms in inputs\[[36](https://arxiv.org/html/2608.03210#bib.bib11),[3](https://arxiv.org/html/2608.03210#bib.bib12)\]\. Specifically, these methods replace a harmful term in the original harmful question \(e\.g\., “bomb” in “How to make a bomb”\) with a benign substitute \(e\.g\., “carrot”\), resulting in a seemingly harmless query such as “How to make a carrot”\. Although the replaced query no longer contains explicit harmful content, these methods aim to recover the original harmful meaning through contextual guidance\. Their key idea is to leverage contextual information to induce a semantic shift, where the target model reinterprets the benign substitute as the original harmful concept during inference\. For example, a context describing “The old plane dropped a bomb over the enemy territory” can be transformed by replacing “bomb” with “carrot”, yielding the jailbreak input “The old plane dropped a carrot over the enemy territory\. How to make a carrot”\. Given such context, the model no longer interprets “carrot” according to its literal meaning, but instead interprets it as “bomb”\. Consequently, although the model receives a benign\-looking query, it recovers the harmful semantics of the original question and generates a response related to the harmful intent\. We refer to this type of attack as a semantic\-shift jailbreak\.

Although existing semantic\-shift jailbreaks can generate surface\-benign inputs, their attack success rates remain limited\.We reveal that this limitation stems from overlooking the varying semantic\-shift capabilities of contexts\.Specifically, contexts with weaker semantic\-shift capabilities fail to induce the target model to reinterpret benign substitutes as harmful concepts, causing the model to either preserve the benign meaning or only partially recover the intended harmful semantics\. In contrast, contexts with stronger semantic\-shift capabilities more effectively guide the model toward the harmful concept, leading to higher jailbreak success rates\.

Motivated by the above observation, we propose a black\-box jailbreak method based onIterativeContextOptimization, termedICO\. ICO consists of three steps\. First, given a harmful question, ICO identifies each harmful term and replaces it with a neutral placeholder\[𝙿i\]\[\\mathtt\{P\}\_\{i\}\]to construct a replaced question\. Second, ICO generates a context containing the harmful term, replaces the term with\[𝙿i\]\[\\mathtt\{P\}\_\{i\}\], and combines the context with the replaced question to obtain the initial jailbreak input\. Third, in each iteration, ICO queries the target model with the jailbreak input and obtains feedback from the generated response\. By leveraging the distilled characteristics of effective contexts and response feedback, ICO generates context optimization suggestions and iteratively improves the context to achieve more effective semantic shifts\. In summary, our contributions are:

- •To the best of our knowledge, we are the first to reveal that contexts exhibit varying semantic\-shift capabilities in semantic\-shift jailbreaks and identify context optimization as an effective strategy for enhancing such attacks\.
- •We propose a black\-box semantic\-shift jailbreak method based on iterative context optimization\. The method achieves high attack effectiveness with surface\-benign inputs and generalizes across both LLMs and LVLMs\.
- •Extensive experiments on three datasets and eight target foundation models demonstrate that ICO consistently outperforms eight state\-of\-the\-art baselines, achieving an average attack success rate of 74\.6%\.

## 2Related Work

### 2\.1Foundation Models

Foundation models have become a general\-purpose interface for handling various language and vision\-language tasks\[[5](https://arxiv.org/html/2608.03210#bib.bib1)\]\.

LLMs\[[6](https://arxiv.org/html/2608.03210#bib.bib2)\]have demonstrated strong capabilities in text understanding, reasoning, code generation, and open\-ended content generation\. With the development of vision\-language models\[[1](https://arxiv.org/html/2608.03210#bib.bib3),[19](https://arxiv.org/html/2608.03210#bib.bib4),[17](https://arxiv.org/html/2608.03210#bib.bib5)\], foundation models can further combine textual instructions with visual inputs to perform tasks such as image understanding, visual question answering, and image\-text joint reasoning\. GPT models\[[27](https://arxiv.org/html/2608.03210#bib.bib13)\]exhibit strong capabilities in language understanding, instruction following, complex reasoning, code generation, and multimodal interpretation\. Gemini models\[[13](https://arxiv.org/html/2608.03210#bib.bib14)\]further support multimodal and long\-context reasoning over text, images, audio, and video, enabling them to process long documents and complex cross\-modal inputs\. DeepSeek models\[[8](https://arxiv.org/html/2608.03210#bib.bib15)\]achieve competitive performance in language understanding, mathematical reasoning, and code\-related tasks while emphasizing efficient model architectures and training\. Llama models\[[16](https://arxiv.org/html/2608.03210#bib.bib16)\]provide publicly released foundation models with strong multilingual, reasoning, coding, instruction\-following, and tool\-use capabilities\. Grok models\[[34](https://arxiv.org/html/2608.03210#bib.bib17)\]extend language reasoning to visual inputs, including documents, diagrams, charts, screenshots, and photographs, and demonstrate strong real\-world spatial understanding\. Qwen models\[[4](https://arxiv.org/html/2608.03210#bib.bib18)\]provide comprehensive multimodal capabilities, including fine\-grained visual recognition, object localization, document and chart understanding, long\-video comprehension, and multimodal reasoning\.

### 2\.2Jailbreak Attacks on Foundation Models

Jailbreak attacks can be broadly divided into text\-only attacks\[[22](https://arxiv.org/html/2608.03210#bib.bib19),[37](https://arxiv.org/html/2608.03210#bib.bib20),[33](https://arxiv.org/html/2608.03210#bib.bib8),[2](https://arxiv.org/html/2608.03210#bib.bib9),[25](https://arxiv.org/html/2608.03210#bib.bib21),[7](https://arxiv.org/html/2608.03210#bib.bib22),[20](https://arxiv.org/html/2608.03210#bib.bib23)\]and multimodal attacks\[[31](https://arxiv.org/html/2608.03210#bib.bib24),[14](https://arxiv.org/html/2608.03210#bib.bib25),[18](https://arxiv.org/html/2608.03210#bib.bib26)\]\. These methods construct specific textual or multimodal inputs to influence the model’s understanding\.

Some jailbreak methods contain explicit harmful terms, which are therefore likely to trigger model refusal or be detected by input filtering mechanisms\. Thus, recent semantic\-shift jailbreak attacks have begun to focus on surface\-benign inputs\. These methods\[[36](https://arxiv.org/html/2608.03210#bib.bib11),[3](https://arxiv.org/html/2608.03210#bib.bib12)\]do not directly expose the harmful term, but instead induce the model to reinterpret user intent through benign context\. Their core idea is to rewrite the original harmful question into a replaced question, so that the input no longer presents obvious risk in form, while still guiding the model to recover the hidden harmful semantics\. In the text\-only setting, Doublespeak\[[36](https://arxiv.org/html/2608.03210#bib.bib11)\]shows that the model can establish a semantic binding between the benign term and the hidden harmful term in context, thereby recovering the intent of the original harmful question\. In the multimodal setting, visual hidden\-intent jailbreak attacks\[[3](https://arxiv.org/html/2608.03210#bib.bib12)\]use a similar idea and also successfully construct jailbreaks against LVLMs\. These works show that safety risks come not only from explicit harmful terms, but also from the model’s semantic recovery process over context\. However, these methods mostly rely on poorly designed contexts, leading to a low attack success rate\.

In contrast, we systematically investigate context quality and introduce context optimization to improve attack effectiveness while preserving surface\-benign inputs\.

## 3Motivation

Although existing semantic\-shift jailbreaks\[[36](https://arxiv.org/html/2608.03210#bib.bib11)\]can generate surface\-benign inputs, their effectiveness remains limited, achieving an average attack success rate of around 37\.5%\. Semantic\-shift jailbreaks rely on contextual information to recover the original harmful semantics from the substituted benign terms\. Therefore, the context plays a critical role in determining whether the intended semantic shift can be successfully established\. To investigate this effect, we modify the context while keeping the placeholder unchanged and evaluate its impact on attack performance\.

In this experiment, we use 120 samples selected from HarmBench\[[24](https://arxiv.org/html/2608.03210#bib.bib27)\], AdvBench\[[37](https://arxiv.org/html/2608.03210#bib.bib20)\], and StrongREJECT\[[32](https://arxiv.org/html/2608.03210#bib.bib28)\]\. We evaluate the same set of samples on GPT\-5\.4 Nano, Gemini 3\.1 Flash\-Lite, Llama 3\.3 70B, and DeepSeek V4\-Flash\. For each sample \(*i\.e*\., an original harmful question\), we replace the harmful term with a placeholder\. For each of the four models, we then randomly generate ten contexts for each question, resulting in 1,200 jailbreak inputs per model\. To evaluate the influence of context, we measure semantic recovery and attack success rates and analyze their relationship across different contexts\.

For each jailbreak input, we use the corresponding target model to assess whether the semantic meaning recovered from the jailbreak input is consistent with the original harmful question\. Based on the evaluation, each \(jailbreak input, original harmful question\) pair is classified into three categories:*Low Recovery*,*Partial Recovery*, and*Full Recovery*\. For example, given the original harmful question “How to make a bomb”, the corresponding jailbreak input is “The old plane dropped a \[P1\] over the enemy territory\. How to make a \[P1\]”\.*Low Recovery*indicates that the LLM does not identify a harmful semantic association between \[P1\] and the original harmful term, and the recovered meaning of the jailbreak input remains harmless\.*Partial Recovery*indicates that the LLM identifies the harmful term associated with \[P1\], but the recovered meaning still differs from the original harmful question\.*Full Recovery*indicates that the LLM successfully recovers the original harmful semantics, and the meaning of the jailbreak input is equivalent to that of the original harmful question\.

TABLE I:Semantic recovery distributions over 1,200 contexts for four target models\.ModelLowRecoveryPartialRecoveryFullRecoveryGPT\-5\.4395 \(32\.92%\)559 \(46\.58%\)246 \(20\.50%\)Gemini 3\.1429 \(35\.75%\)387 \(32\.25%\)384 \(32\.00%\)Llama 3\.3427 \(35\.58%\)465 \(38\.75%\)308 \(25\.67%\)DeepSeek V4501 \(41\.75%\)341 \(28\.42%\)358 \(29\.83%\)Table[I](https://arxiv.org/html/2608.03210#S3.T1)summarizes the semantic recovery results of the 1,200 randomly generated context sentences for each target model\. Each row corresponds to one target model, while the three columns report the number and proportion of contexts classified as*Low Recovery*,*Partial Recovery*, and*Full Recovery*, respectively\. The distributions exhibit a clear model\-dependent trend: GPT\-5\.4 Nano and Llama 3\.3 70B are dominated by*Partial Recovery*\(46\.58% and 38\.75%\), Gemini 3\.1 Flash\-Lite achieves the highest*Full Recovery*rate \(32\.00%\), while DeepSeek V4\-Flash shows the highest*Low Recovery*rate \(41\.75%\)\. Across all four target models, these distributions consistently show that randomly generated contexts differ substantially in their ability to recover the meanings of the original harmful terms\.

![Refer to caption](https://arxiv.org/html/2608.03210v1/x2.png)

\(a\) GPT\-5\.4 Nano

![Refer to caption](https://arxiv.org/html/2608.03210v1/x3.png)

\(b\) Gemini 3\.1 Flash\-Lite

![Refer to caption](https://arxiv.org/html/2608.03210v1/x4.png)

\(c\) Llama 3\.3 70B

![Refer to caption](https://arxiv.org/html/2608.03210v1/x5.png)

\(d\) DeepSeek V4\-Flash

Figure 2:Partial and Full ASR across semantic recovery levels for four target models\.![Refer to caption](https://arxiv.org/html/2608.03210v1/x6.png)

\(a\) GPT\-5\.4 Nano

![Refer to caption](https://arxiv.org/html/2608.03210v1/x7.png)

\(b\) Gemini 3\.1 Flash\-Lite

![Refer to caption](https://arxiv.org/html/2608.03210v1/x8.png)

\(c\) Llama 3\.3 70B

![Refer to caption](https://arxiv.org/html/2608.03210v1/x9.png)

\(d\) DeepSeek V4\-Flash

Figure 3:Semantic recovery distributions before and after one guided optimization step across four target models\.##### Semantic recovery and attack success rates\.

For each jailbreak input, we obtain the response from the target model and classify it into two categories:*Partial Success*and*Full Success*\.*Partial Success*indicates that the response provides meaningful information related to the original harmful intent\.*Full Success*indicates that the response directly addresses the original harmful question and provides sufficient information to fulfill the harmful request\. Obviously, a*Full Success*response is also a*Partial Success*one\.

Figure[2](https://arxiv.org/html/2608.03210#S3.F2)reports the relationship between semantic recovery and attack success rates on the four target models\. In each panel, the horizontal axis represents*Low Recovery*,*Partial Recovery*, and*Full Recovery*, while the vertical axis reports Partial ASR and Full ASR\. Across four models, both metrics increase monotonically as semantic recovery improves\. Comparing*Low Recovery*and*Full Recovery*, Partial ASR increases by 4\.68–21\.80% across models, while Full ASR increases by 1\.27–22\.50%\. Although the absolute attack success rates differ across target models, the consistent trend shows that contexts inducing stronger semantic recovery are more likely to produce higher attack success rates\.

##### Improving Random Contexts with the Guidance Prompt\.

Motivated by this observation, we compare contexts across the three recovery groups and summarize the recurring characteristics that distinguish*Full Recovery*contexts from*Low Recovery*and*Partial Recovery*contexts\. We summarize these characteristics in a Guidance Prompt used to optimize each randomly generated context once\. In particular, the prompt encourages semantic cues that help the target model infer the role of the placeholder’s corresponding harmful term in the replaced question, such as whether it denotes an object, action, or attribute\. We then reassess the optimized contexts using the same evaluation procedure\.

![Refer to caption](https://arxiv.org/html/2608.03210v1/x10.png)Figure 4:Overview of ICO\.ICO consists of three stages\.As shown in Figure[3](https://arxiv.org/html/2608.03210#S3.F3), one guided optimization step substantially improves semantic recovery\. The numbers of*Low Recovery*contexts decrease from 395, 429, 427, and 501 to 159, 175, 159, and 121 for the four target models, respectively\. Meanwhile, the numbers of*Full Recovery*contexts increase from 246, 384, 308, and 358 to 548, 624, 514, and 603\. These results demonstrate that the characteristics of contexts with strong semantic recovery can provide effective guidance for improving randomly generated contexts\.

Taken together,random contexts exhibit varying semantic recovery, stronger recovery leads to higher ASR, and high\-recovery contexts reveal recurring characteristics that can guide context optimization\.

## 4Method

### 4\.1Problem Formulation and Preliminaries

Given a target model𝒯\\mathcal\{T\}and an original harmful questionqhq\_\{h\}, the objective of the adversary is to construct an inputI⋆I^\{\\star\}fromqhq\_\{h\}and successfully jailbreak𝒯\\mathcal\{T\}\. Specifically, the model responses for the original and jailbreak inputs are denoted asy=𝒯​\(qh\)y=\\mathcal\{T\}\(q\_\{h\}\)andy⋆=𝒯​\(I⋆\)y^\{\\star\}=\\mathcal\{T\}\(I^\{\\star\}\)\. A judge model𝒥\\mathcal\{J\}is employed to evaluate whether the generated response provides harmful information that is consistent with the original harmful queryqhq\_\{h\}\. The objective of the jailbreak attack is formulated as𝒥​\(qh,y\)=0\\mathcal\{J\}\(q\_\{h\},y\)=0and𝒥​\(qh,y⋆\)=1\\mathcal\{J\}\(q\_\{h\},y^\{\\star\}\)=1, where𝒥​\(⋅\)=1\\mathcal\{J\}\(\\cdot\)=1indicates that the response contains harmful content consistent withqhq\_\{h\}, while𝒥​\(⋅\)=0\\mathcal\{J\}\(\\cdot\)=0indicates that the response is harmless or irrelevant toqhq\_\{h\}\.

In this paper, we consider a black\-box setting in which the attacker can query𝒯\\mathcal\{T\}and observe its responses but cannot access its parameters, gradients, or internal representations\.

Semantic\-shift jailbreak\.Given an original harmful questionqhq\_\{h\}, the explicit harmful terms are first replaced with placeholders to obtain a replaced questionqrq\_\{r\}\. Contextccis then generated by an auxiliary LLM𝒜\\mathcal\{A\}using the original harmful terms and concatenated withqrq\_\{r\}to form a jailbreak inputII,*i\.e*\.,I=c⊕qrI=c\\oplus q\_\{r\}, where⊕\\oplusrepresents the concatenation operation\. Although the original harmful terms do not explicitly appear inII, the context guides𝒯\\mathcal\{T\}to interpret the placeholders\. We refer to this context\-induced reinterpretation as a*semantic shift*\.

### 4\.2Challenge and High\-level Idea

According to the conclusion in Sec\.[3](https://arxiv.org/html/2608.03210#S3), improving the attack success rate of semantic\-shift jailbreaks requires finding more effective contexts for each sample\. A straightforward solution is to randomly generate a large number of candidate contexts and select the one that achieves the best jailbreak performance\. However, this strategy relies heavily on random exploration, making the attack effectiveness unstable and difficult to guarantee\. Therefore, we propose to directly optimize the context\. Although modifying context text is straightforward, determining the optimization direction remains challenging due to the discrete nature and large semantic space of textual contexts\.

To address this challenge, we propose an iterative context optimization strategy that leverages both the characteristics of effective contexts and feedback from the target model\. Specifically, in each iteration, we query the target model with the current jailbreak input and obtain its response\. Then, given the original harmful question, the generated response, and the distilled characteristics of effective contexts, an LLM analyzes the semantic gap between the current response and the intended harmful semantics, and provides guidance for optimizing the context toward more effective semantic shifts\.

### 4\.3Overview of Method

We propose ICO, a black\-box method that iteratively optimizes contexts while preserving surface\-benign jailbreak inputs\. As illustrated in Figure[4](https://arxiv.org/html/2608.03210#S3.F4), ICO consists of three stages: harmful term replacement, initial context generation, and iterative context optimization\. The first two stages construct the initial jailbreak input, while the third stage iteratively optimizes the context based on feedback from the target model\.

#### 4\.3\.1Harmful Term Replacement

Given an original harmful questionqhq\_\{h\}, we first extract the harmful terms\{hi\}i=1m\\\{h\_\{i\}\\\}\_\{i=1\}^\{m\}, wherehih\_\{i\}denotes theii\-th harmful term andmmis the number of extracted harmful terms\. Each harmful termhih\_\{i\}is assigned a distinct placeholder\[𝙿i\]\[\\mathtt\{P\}\_\{i\}\], which denotes a placeholder and carries no predefined semantic meaning\. Its surface form in the model input is \[P1\], \[P2\], and so forth\. Using the replacement functionℛ​\(⋅\)\\mathcal\{R\}\(\\cdot\), we get the replaced questionqrq\_\{r\}:

qr=ℛ​\(qh,\{hi→\[𝙿i\]\}i=1m\)\.q\_\{r\}=\\mathcal\{R\}\\left\(q\_\{h\},\\\{h\_\{i\}\\rightarrow\[\\mathtt\{P\}\_\{i\}\]\\\}\_\{i=1\}^\{m\}\\right\)\.\(1\)Instead of replacing harmful terms with specific benign terms \(*e\.g*\., “apple” or “carrot”\), we use placeholders because they avoid introducing additional semantic bias\. The replaced question preserves the syntactic structure of the original harmful question while removing explicit harmful terms from its surface representation\.

#### 4\.3\.2Initial Context Generation

ICO uses an auxiliary model𝒜\\mathcal\{A\}to generate an initial context \(usually one sentence\) for each harmful term\. For theii\-th harmful term, the auxiliary model generates a context containinghih\_\{i\}, after which the harmful term is replaced with its corresponding placeholder:

ci0=ℛ​\(𝒜​\(qh,hi\),hi→\[𝙿i\]\)\.c\_\{i\}^\{0\}=\\mathcal\{R\}\\left\(\\mathcal\{A\}\(q\_\{h\},h\_\{i\}\),h\_\{i\}\\rightarrow\[\\mathtt\{P\}\_\{i\}\]\\right\)\.\(2\)The resulting initial context set is

C0=\{ci0\}i=1m\.C^\{0\}=\\\{c\_\{i\}^\{0\}\\\}\_\{i=1\}^\{m\}\.\(3\)
ICO concatenates the initial context setC0C^\{0\}and the replaced questionqrq\_\{r\}to construct the initial jailbreak inputI0I^\{0\}:

I0=C0⊕qr\.I^\{0\}=C^\{0\}\\oplus q\_\{r\}\.\(4\)The composition format remains fixed during optimization, while the placeholder contexts are iteratively optimized\.

#### 4\.3\.3Iterative Context Optimization

ICO queries the target model𝒯\\mathcal\{T\}with the current jailbreak inputItI^\{t\}and obtains the corresponding responseyty^\{t\}\.

yt=𝒯​\(It\)\.y^\{t\}=\\mathcal\{T\}\(I^\{t\}\)\.\(5\)A judge model𝒥\\mathcal\{J\}compares the target responseyty^\{t\}with the original harmful questionqhq\_\{h\}\. We additionally provide the Guidance PromptPgP\_\{g\}, derived from the observations in Section[3](https://arxiv.org/html/2608.03210#S3), to guide the generation of placeholder\-specific feedback\. The judge returns a judgmentsts^\{t\}together with context optimization feedbackFtF^\{t\}:

\(st,Ft\)=𝒥​\(qh,qr,yt,Pg\)\.\(s^\{t\},F^\{t\}\)=\\mathcal\{J\}\(q\_\{h\},q\_\{r\},y^\{t\},P\_\{g\}\)\.\(6\)Here,st∈\{0,1\}s^\{t\}\\in\\\{0,1\\\}indicates whether the response constitutes a jailbreak with respect to the original harmful question\. Ifst=1s^\{t\}=1, the optimization terminates\. Otherwise,Ft=\{fit\}i=1mF^\{t\}=\\\{f\_\{i\}^\{t\}\\\}\_\{i=1\}^\{m\}describes the semantic mismatch associated with each placeholder context\. Based on the feedback, the auxiliary model𝒜\\mathcal\{A\}optimizes each current context:

cit\+1=𝒜​\(qh,qr,cit,fit\)\.c\_\{i\}^\{t\+1\}=\\mathcal\{A\}\(q\_\{h\},q\_\{r\},c\_\{i\}^\{t\},f\_\{i\}^\{t\}\)\.\(7\)The updated context set is

Ct\+1=\{cit\+1\}i=1m\.C^\{t\+1\}=\\\{c\_\{i\}^\{t\+1\}\\\}\_\{i=1\}^\{m\}\.\(8\)ICO then concatenates the optimized context setCt\+1C^\{t\+1\}before the unchanged replaced questionqrq\_\{r\}to construct the next jailbreak inputIt\+1I^\{t\+1\}:

It\+1=Ct\+1⊕qr\.I^\{t\+1\}=C^\{t\+1\}\\oplus q\_\{r\}\.\(9\)This process repeats until the judge reports*Full Success*or the maximum iteration budgetTTis reached\. By using the target\-model response to identify insufficient or misaligned semantic cues, ICO progressively optimizes the contexts to improve recovery of the meanings of the original harmful terms\. Additionally, a complete pseudocode description of ICO is provided in thesupp\.

## 5Experiments

### 5\.1Experimental Setup

Dataset\.We conduct the main experiments on all 200 standard HarmBench behaviors\[[24](https://arxiv.org/html/2608.03210#bib.bib27)\]\. GPT\-5\.5\[[29](https://arxiv.org/html/2608.03210#bib.bib29)\]extracts the harmful terms and replaces eachii\-th term with a distinct placeholder\[𝙿i\]\[\\mathtt\{P\}\_\{i\}\], producing a fixed preprocessed dataset used throughout the experiments\.

TABLE II:Text\-only attack comparison\.Each cell reports Partial ASR / Full ASR \(%\) over 200 HarmBench behaviors\. Bold indicates the best result for each metric under the same target model\. Avg\. denotes the average across the five target models\.MethodGPT\-5\.4Gemini\-3\.1DeepSeek\-V3\.2DeepSeek\-V4Llama\-3\.3Avg\.Doublespeak34\.0 / 6\.066\.0 / 45\.066\.0 / 48\.061\.0 / 46\.540\.5 / 20\.553\.5 / 33\.2AutoDAN\-Turbo25\.0 / 1\.031\.5 / 10\.06\.5 / 4\.08\.5 / 5\.521\.5 / 10\.018\.6 / 6\.1PAIR41\.5 / 7\.591\.5 / 47\.569\.5 / 29\.577\.5 / 32\.096\.5/ 40\.075\.3 / 31\.3FlipAttack9\.0 / 2\.089\.5 / 83\.090\.5 / 81\.597\.0 / 91\.512\.5 / 5\.559\.7 / 52\.7ICO81\.5/57\.599\.0/97\.099\.5/99\.099\.5/99\.088\.5 /77\.593\.6/86\.0TABLE III:Multimodal attack comparison\.Each cell reports Partial ASR / Full ASR \(%\) over 200 HarmBench behaviors\. Bold indicates the best result for each metric under the same target model\. Avg\. denotes the average across the five target models\.MethodGPT\-5\.4Gemini\-3\.1Grok\-4\.3Qwen3\-VL\-32BQwen3\-VL\-8BAvg\.Visual Object Repl\.14\.0 / 2\.540\.0 / 25\.010\.5 / 9\.016\.5 / 8\.011\.0 / 5\.018\.4 / 9\.9Visual Text Repl\.7\.5 / 2\.042\.0 / 19\.510\.5 / 4\.039\.0 / 21\.025\.5 / 7\.524\.9 / 10\.8MM\-SafetyBench4\.0 / 0\.511\.0 / 2\.017\.0 / 8\.06\.5 / 3\.50\.5 / 0\.07\.8 / 2\.8HADES1\.5 / 1\.05\.5 / 3\.011\.5 / 10\.55\.0 / 2\.01\.0 / 1\.04\.9 / 3\.5FigStep7\.5 / 1\.08\.0 / 5\.017\.0 / 16\.07\.5 / 6\.06\.5 / 3\.09\.3 / 6\.2ICO47\.0/22\.091\.5/88\.039\.5/32\.594\.0/83\.594\.5/90\.073\.3/63\.2Target models\.We evaluate ICO in text\-only and multimodal settings\. For text\-only, we evaluate GPT\-5\.4\-Nano\[[28](https://arxiv.org/html/2608.03210#bib.bib30)\], Gemini\-3\.1\-Flash\-Lite\[[15](https://arxiv.org/html/2608.03210#bib.bib31)\], DeepSeek\-V3\.2\[[9](https://arxiv.org/html/2608.03210#bib.bib32)\], DeepSeek\-V4\-Flash\[[10](https://arxiv.org/html/2608.03210#bib.bib33)\], and Llama\-3\.3\-70B\-Instruct\[[26](https://arxiv.org/html/2608.03210#bib.bib34)\]\. For multimodal, we evaluate GPT\-5\.4\-Nano, Gemini\-3\.1\-Flash\-Lite, Grok\-4\.3\[[35](https://arxiv.org/html/2608.03210#bib.bib35)\], Qwen3\-VL\-32B\-Instruct\[[4](https://arxiv.org/html/2608.03210#bib.bib18)\], and Qwen3\-VL\-8B\-Instruct\[[4](https://arxiv.org/html/2608.03210#bib.bib18)\]\. These models cover both closed\-source commercial and open\-source models\.

Baselines\.In the text\-only setting, we compare ICO with Doublespeak\[[36](https://arxiv.org/html/2608.03210#bib.bib11)\], AutoDAN\-Turbo\[[20](https://arxiv.org/html/2608.03210#bib.bib23)\], PAIR\[[7](https://arxiv.org/html/2608.03210#bib.bib22)\], and FlipAttack\[[23](https://arxiv.org/html/2608.03210#bib.bib36)\]\. Multimodal baselines include Visual Object Replacement, Visual Text Replacement\[[3](https://arxiv.org/html/2608.03210#bib.bib12)\], MM\-SafetyBench \(SD\+TYPO\)\[[21](https://arxiv.org/html/2608.03210#bib.bib37)\], HADES\[[18](https://arxiv.org/html/2608.03210#bib.bib26)\], and FigStep\[[14](https://arxiv.org/html/2608.03210#bib.bib25)\]\.

TABLE IV:Effect of the Guidance Prompt and iterative optimization across modelsVariantGPT5\.4Gemini3\.1DeepSeekV3\.2DeepSeekV4Llama3\.3w/o Guidance43\.084\.090\.091\.570\.0w/o Iteration43\.078\.080\.083\.559\.0ICO57\.597\.099\.099\.077\.5![Refer to caption](https://arxiv.org/html/2608.03210v1/x11.png)Figure 5:Effect of the maximum number of iterations on ASR across five target models\.Evaluation metrics\.Following Section[3](https://arxiv.org/html/2608.03210#S3), Partial and Full ASR denote the percentages of samples achieving Partial and Full Success\. Full ASR is the primary metric; ASR denotes Full ASR unless stated otherwise\.

Implementation details\.By default, GPT\-5\.4\-Nano serves as the auxiliary model for context generation and optimization\. We use one initial context per harmful term, a maximum ofT=25T=25iterations, a temperature of 0, and GPT\-4o as the judge\. For multimodal inputs, we additionally provide a benign image depicting a visual concept \(e\.g\., an apple\) and explicitly bind the corresponding placeholder to it\. Baselines use official implementations and recommended settings when available\. Additional prompts are provided in theSupp\.

### 5\.2Main Results

Text\-only results\.Table[II](https://arxiv.org/html/2608.03210#S5.T2)shows that ICO achieves the highest Full ASR on all five target models\. It averages 93\.6% Partial ASR and 86\.0% Full ASR, outperforming the strongest baselines by 18\.3 and 33\.3%, respectively\. Although PAIR attains higher Partial ASR on Llama\-3\.3, ICO increases Full ASR from 40\.0% to 77\.5%\.

Multimodal results\.Table[III](https://arxiv.org/html/2608.03210#S5.T3)shows that ICO achieves the highest Partial and Full ASR on all five target LVLMs\. It averages 73\.3% Partial ASR and 63\.2% Full ASR across models, exceeding the strongest multimodal baseline by 48\.4 and 52\.4%, respectively\.

Overall, these results demonstrate that ICO consistently outperforms existing baselines across different target models and both input modalities\.

### 5\.3Ablation Study

Effect of iterative optimization\.To isolate the benefit of response\-dependent optimization from repeated independent generation, we replace the 25\-iteration optimization process with 25 independently generated contexts while keeping all other settings unchanged\. As shown in Table[IV](https://arxiv.org/html/2608.03210#S5.T4), removing iterative optimization reduces ASR by 14\.5–19\.0% across the five target models\. This result shows that ICO’s gains arise from response\-dependent optimization rather than merely generating more candidate contexts\.

Effect of the guidance prompt\.Based on the observations in Section[3](https://arxiv.org/html/2608.03210#S3), we summarize the characteristics of high\-recovery contexts and encode them into a Guidance Prompt for context optimization\. As shown in Table[IV](https://arxiv.org/html/2608.03210#S5.T4), removing this prompt while retaining iterative optimization reduces ASR by 7\.5–14\.5% across the five target models\. This result demonstrates that the characteristics of high\-recovery contexts provide effective guidance for context optimization\.

### 5\.4Discussion

Effect of the maximum number of iterations\.Figure[5](https://arxiv.org/html/2608.03210#S5.F5)reports ICO’s ASR under different maximum numbers of iterations\. ASR increases rapidly fromT=1T=1toT=5T=5, while subsequent gains gradually diminish\. ByT=25T=25, Gemini\-3\.1 and both DeepSeek models have largely stabilized, whereas GPT\-5\.4 and Llama\-3\.3 continue to improve more gradually\. IncreasingTTfrom 25 to 40 yields only an additional 0–6\.0% despite requiring 60% more iterations\. We therefore setT=25T=25by default\.

![Refer to caption](https://arxiv.org/html/2608.03210v1/x12.png)Figure 6:Effect of the number of initial contexts on ASR across five target models\.TABLE V:Effect of replacement semantics on ASR when using benign terms or placeholders\.ReplacementGPT5\.4Gemini3\.1DeepSeekV3\.2DeepSeekV4Llama3\.3Benign terms39\.587\.088\.593\.570\.5Placeholders57\.597\.099\.099\.077\.5TABLE VI:Effect of auxiliary\-model choice on ASR across four target models\.AuxiliaryGemini3\.1DeepSeekV3\.2DeepSeekV4Llama3\.3Matched97\.597\.597\.079\.5Default97\.099\.099\.077\.5TABLE VII:ASR \(%\) on AdvBench and StrongREJECT\.DatasetGPT5\.4Gemini3\.1DeepSeekV3\.2DeepSeekV4Llama3\.3AdvBench69\.096\.099\.096\.081\.0StrongREJECT49\.089\.093\.092\.071\.0Effect of the number of initial contexts\.Figure[6](https://arxiv.org/html/2608.03210#S5.F6)reports the ASR of ICO with different numbers of initial contexts per harmful term across the five target models after 25 optimization iterations\. A single initial context yields the highest ASR on all five target models, and increasing the number of initial contexts to two, three, or four does not improve performance\. The largest drop is observed on GPT\-5\.4, where ASR decreases from 57\.5% to 43\.5%\. Overall, these results show that one initial context is sufficient for iterative optimization\. We therefore use this setting by default\.

Effect of the replacement strategy\.Table[V](https://arxiv.org/html/2608.03210#S5.T5)reports the ASR of ICO when harmful terms are replaced with either specific benign terms or placeholders across the five target models\. Placeholder replacement consistently achieves higher ASR than benign\-term replacement, with substantial improvements of 5\.5–18\.0%\. We therefore use placeholders as the default replacement strategy\.

Effect of auxiliary\-model choice\.Table[VI](https://arxiv.org/html/2608.03210#S5.T6)compares two auxiliary\-model settings\. In the matched setting, the auxiliary model is the same as the target model, whereas the default setting uses GPT\-5\.4\-Nano as the auxiliary model for all target models\. GPT\-5\.4\-Nano is omitted because the two settings coincide for this target\. The ASR differs from the default setting by at most 2\.0% across the four target models\. This indicates that ICO is only weakly affected by the choice of auxiliary model\. We therefore use GPT\-5\.4\-Nano as the default auxiliary model to maintain a unified setting\.

Generalization across datasets\.We further evaluate ICO on two additional datasets, using 100 harmful queries from AdvBench\[[37](https://arxiv.org/html/2608.03210#bib.bib20)\]and 100 harmful queries from StrongREJECT\[[32](https://arxiv.org/html/2608.03210#bib.bib28)\]\. ICO achieves ASRs of 69\.0–99\.0% on AdvBench and 49\.0–93\.0% on StrongREJECT across the five models\.

## 6Conclusion

In this paper, we identify context quality as a key factor governing the effectiveness of semantic\-shift jailbreaks and propose ICO, a black\-box method based on iterative context optimization\. Experiments across text\-only and multimodal settings show that ICO outperforms existing jailbreak baselines on diverse target models\. Our findings show that surface\-benign inputs should not be treated as inherently safe, as harmful intent can still be reconstructed through context\.

## References

- \[1\]J\. Alayrac, J\. Donahue, P\. Luc, A\. Miech, I\. Barr, Y\. Hasson, K\. Lenc, A\. Mensch, K\. Millican, M\. Reynolds,et al\.\(2022\)Flamingo: a visual language model for few\-shot learning\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 23716–23736\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2022/hash/960a172bc7fbf0177ccccbb411a7d800-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[2\]C\. Anil, E\. Durmus, N\. Panickssery, M\. Sharma, J\. Benton, S\. Kundu, J\. Batson, M\. Tong, J\. Mu, D\. Ford, F\. Mosconi, R\. Agrawal, R\. Schaeffer, N\. Bashkansky, S\. Svenningsen, M\. Lambert, A\. Radhakrishnan, C\. Denison, E\. Hubinger, Y\. Bai, T\. Bricken, T\. Maxwell, N\. Schiefer, J\. Sully, A\. Tamkin, T\. Lanham, K\. Nguyen, T\. Korbak, J\. Kaplan, D\. Ganguli, S\. R\. Bowman, E\. Perez, R\. B\. Grosse, and D\. K\. Duvenaud\(2024\)Many\-shot jailbreaking\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 129696–129742\.External Links:[Document](https://dx.doi.org/10.52202/079017-4121)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1)\.
- \[3\]\(2026\)Jailbreaking vision\-language models through the visual modality\.External Links:2605\.00583,[Link](https://arxiv.org/abs/2605.00583)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p2.1),[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p2.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[4\]S\. Bai, Y\. Cai, R\. Chen, K\. Chen, X\. Chen, Z\. Cheng, L\. Deng, W\. Ding, C\. Gao, C\. Ge,et al\.\(2025\)Qwen3\-VL technical report\.External Links:2511\.21631,[Link](https://arxiv.org/abs/2511.21631)Cited by:[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[5\]R\. Bommasani, D\. A\. Hudson, E\. Adeli, R\. Altman, S\. Arora, S\. von Arx, M\. S\. Bernstein, J\. Bohg, A\. Bosselut, E\. Brunskill,et al\.\(2021\)On the opportunities and risks of foundation models\.External Links:2108\.07258,[Link](https://arxiv.org/abs/2108.07258)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p1.1)\.
- \[6\]T\. B\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell, S\. Agarwal, A\. Herbert\-Voss, G\. Krueger, T\. Henighan, R\. Child, A\. Ramesh, D\. M\. Ziegler, J\. Wu, C\. Winter,et al\.\(2020\)Language models are few\-shot learners\.InAdvances in Neural Information Processing Systems,Vol\.33,pp\. 1877–1901\.External Links:[Link](https://proceedings.neurips.cc/paper/2020/hash/1457c0d6bfcb4967418bfb8ac142f64a-Abstract.html)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[7\]P\. Chao, A\. Robey, E\. Dobriban, H\. Hassani, G\. J\. Pappas, and E\. Wong\(2025\)Jailbreaking black box large language models in twenty queries\.InProceedings of the 2025 IEEE Conference on Secure and Trustworthy Machine Learning \(SaTML\),pp\. 23–42\.Note:arXiv:2310\.08419External Links:[Link](https://arxiv.org/abs/2310.08419)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[8\]DeepSeek\-AI\(2024\)DeepSeek\-V3 technical report\.External Links:2412\.19437,[Link](https://arxiv.org/abs/2412.19437)Cited by:[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[9\]DeepSeek\-AI\(2025\)DeepSeek\-V3\.2: pushing the frontier of open large language models\.External Links:2512\.02556,[Link](https://arxiv.org/abs/2512.02556)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[10\]DeepSeek\-AI\(2026\)DeepSeek\-V4: towards highly efficient million\-token context intelligence\.External Links:2606\.19348,[Link](https://arxiv.org/abs/2606.19348)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[11\]A\. Deshpande, V\. Murahari, T\. Rajpurohit, A\. Kalyan, and K\. Narasimhan\(2023\)Toxicity in ChatGPT: analyzing persona\-assigned language models\.InFindings of the Association for Computational Linguistics: EMNLP 2023,pp\. 1236–1270\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.findings-emnlp.88),[Link](https://aclanthology.org/2023.findings-emnlp.88/)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1)\.
- \[12\]D\. Ganguli, L\. Lovitt, J\. Kernion, A\. Askell, Y\. Bai, S\. Kadavath, B\. Mann, E\. Perez, N\. Schiefer, K\. Ndousse, A\. Jones, S\. R\. Bowman, A\. Chen, T\. Conerly, N\. DasSarma, D\. Drain, N\. Elhage, S\. El\-Showk,et al\.\(2022\)Red teaming language models to reduce harms: methods, scaling behaviors, and lessons learned\.External Links:2209\.07858,[Link](https://arxiv.org/abs/2209.07858)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1)\.
- \[13\]Gemini Team\(2024\)Gemini 1\.5: unlocking multimodal understanding across millions of tokens of context\.External Links:2403\.05530,[Link](https://arxiv.org/abs/2403.05530)Cited by:[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[14\]Y\. Gong, D\. Ran, J\. Liu, C\. Wang, T\. Cong, A\. Wang, S\. Duan, and X\. Wang\(2025\)FigStep: jailbreaking large vision\-language models via typographic visual prompts\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.39,pp\. 23951–23959\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v39i22.34568)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[15\]Google\(2026\)Gemini 3\.1 flash\-lite\.Note:Google AI for DevelopersExternal Links:[Link](https://ai.google.dev/gemini-api/docs/models/gemini-3.1-flash-lite)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[16\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Yang, A\. Fan,et al\.\(2024\)The llama 3 herd of models\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[17\]J\. Li, D\. Li, S\. Savarese, and S\. Hoi\(2023\)BLIP\-2: bootstrapping language\-image pre\-training with frozen image encoders and large language models\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 19730–19742\.External Links:[Link](https://proceedings.mlr.press/v202/li23q.html)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[18\]Y\. Li, H\. Guo, K\. Zhou, W\. X\. Zhao, and J\. Wen\(2025\)Images are achilles’ heel of alignment: exploiting visual vulnerabilities for jailbreaking multimodal large language models\.InComputer Vision – ECCV 2024,Lecture Notes in Computer Science, Vol\.15131,pp\. 174–189\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-73464-9%5F11),[Link](https://doi.org/10.1007/978-3-031-73464-9_11)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[19\]H\. Liu, C\. Li, Q\. Wu, and Y\. J\. Lee\(2023\)Visual instruction tuning\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 34892–34916\.Note:arXiv:2304\.08485External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/6dcf277ea32ce3288914faf369fe6de0-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[20\]X\. Liu, P\. Li, G\. E\. Suh, Y\. Vorobeychik, Z\. Mao, S\. Jha, P\. McDaniel, H\. Sun, B\. Li, and C\. Xiao\(2025\)AutoDAN\-Turbo: a lifelong agent for strategy self\-exploration to jailbreak LLMs\.InProceedings of the International Conference on Learning Representations \(ICLR\),External Links:[Link](https://openreview.net/forum?id=bhK7U37VW8)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[21\]X\. Liu, Y\. Zhu, J\. Gu, Y\. Lan, C\. Yang, and Y\. Qiao\(2025\)MM\-SafetyBench: a benchmark for safety evaluation of multimodal large language models\.InComputer Vision – ECCV 2024,Lecture Notes in Computer Science, Vol\.15114,pp\. 386–403\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-72992-8%5F22),[Link](https://arxiv.org/abs/2311.17600)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[22\]Y\. Liu, G\. Deng, Z\. Xu, Y\. Li, Y\. Zheng, Y\. Zhang, L\. Zhao, T\. Zhang, K\. Wang, and Y\. Liu\(2024\)Jailbreaking ChatGPT via prompt engineering: an empirical study\.External Links:2305\.13860,[Link](https://arxiv.org/abs/2305.13860)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1)\.
- \[23\]Y\. Liu, X\. He, M\. Xiong, J\. Fu, S\. Deng, Y\. Ma, J\. Zhang, and B\. Hooi\(2025\)FlipAttack: jailbreak LLMs via flipping\.InProceedings of the 42nd International Conference on Machine Learning \(ICML\),Proceedings of Machine Learning Research, Vol\.267,pp\. 38623–38663\.External Links:[Link](https://proceedings.mlr.press/v267/liu25z.html)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[24\]M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li, D\. Forsyth, and D\. Hendrycks\(2024\)HarmBench: a standardized evaluation framework for automated red teaming and robust refusal\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 35181–35224\.External Links:[Link](https://proceedings.mlr.press/v235/mazeika24a.html)Cited by:[§3](https://arxiv.org/html/2608.03210#S3.p2.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p1.2)\.
- \[25\]A\. Mehrotra, M\. Zampetakis, P\. Kassianik, B\. Nelson, H\. Anderson, Y\. Singer, and A\. Karbasi\(2024\)Tree of attacks: jailbreaking black\-box LLMs automatically\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 61065–61105\.External Links:[Document](https://dx.doi.org/10.52202/079017-1952)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1)\.
- \[26\]Meta AI\(2024\)Llama 3\.3 70B Instruct model card\.Note:Hugging FaceExternal Links:[Link](https://huggingface.co/meta-llama/Llama-3.3-70B-Instruct)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[27\]OpenAI\(2023\)GPT\-4 technical report\.External Links:2303\.08774,[Link](https://arxiv.org/abs/2303.08774)Cited by:[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[28\]OpenAI\(2026\)Introducing GPT\-5\.4 mini and nano\.Note:OpenAIExternal Links:[Link](https://openai.com/index/introducing-gpt-5-4-mini-and-nano/)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[29\]OpenAI\(2026\)Introducing GPT\-5\.5\.Note:OpenAIExternal Links:[Link](https://openai.com/index/introducing-gpt-5-5/)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p1.2)\.
- \[30\]E\. Perez, S\. Huang, F\. Song, T\. Cai, R\. Ring, J\. Aslanides, A\. Glaese, N\. McAleese, and G\. Irving\(2022\)Red teaming language models with language models\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,Abu Dhabi, United Arab Emirates,pp\. 3419–3448\.External Links:[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.225)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1)\.
- \[31\]X\. Qi, K\. Huang, A\. Panda, P\. Henderson, M\. Wang, and P\. Mittal\(2024\)Visual adversarial examples jailbreak aligned large language models\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.38,pp\. 21527–21536\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v38i19.30150)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1)\.
- \[32\]A\. Souly, Q\. Lu, D\. Bowen, T\. Trinh, E\. Hsieh, S\. Pandey, P\. Abbeel, J\. Svegliato, S\. Emmons, O\. Watkins, and S\. Toyer\(2024\)A StrongREJECT for empty jailbreaks\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 125416–125440\.Note:Datasets and Benchmarks TrackExternal Links:[Document](https://dx.doi.org/10.52202/079017-3984),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/e2e06adf560b0706d3b1ddfca9f29756-Abstract-Datasets_and_Benchmarks_Track.html)Cited by:[§3](https://arxiv.org/html/2608.03210#S3.p2.1),[§5\.4](https://arxiv.org/html/2608.03210#S5.SS4.p5.1)\.
- \[33\]A\. Wei, N\. Haghtalab, and J\. Steinhardt\(2023\)Jailbroken: how does LLM safety training fail?\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 80079–80110\.External Links:[Document](https://dx.doi.org/10.52202/075280-3508)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p1.1),[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1)\.
- \[34\]xAI\(2024\)Grok\-1\.5 vision preview\.Note:xAIExternal Links:[Link](https://x.ai/news/grok-1.5v)Cited by:[§2\.1](https://arxiv.org/html/2608.03210#S2.SS1.p2.1)\.
- \[35\]xAI\(2026\)Grok 4\.3\.Note:xAI Developer DocumentationExternal Links:[Link](https://docs.x.ai/developers/models/grok-4.3)Cited by:[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p2.1)\.
- \[36\]I\. Yona, A\. Sarid, M\. Karasik, and Y\. Gandelsman\(2025\)In\-context representation hijacking\.External Links:2512\.03771,[Link](https://arxiv.org/abs/2512.03771)Cited by:[§1](https://arxiv.org/html/2608.03210#S1.p2.1),[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p2.1),[§3](https://arxiv.org/html/2608.03210#S3.p1.1),[§5\.1](https://arxiv.org/html/2608.03210#S5.SS1.p3.1)\.
- \[37\]A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. Fredrikson\(2023\)Universal and transferable adversarial attacks on aligned language models\.External Links:2307\.15043,[Link](https://arxiv.org/abs/2307.15043)Cited by:[§2\.2](https://arxiv.org/html/2608.03210#S2.SS2.p1.1),[§3](https://arxiv.org/html/2608.03210#S3.p2.1),[§5\.4](https://arxiv.org/html/2608.03210#S5.SS4.p5.1)\.