{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/obscureprompt-jailbreaking-large-language","title":"Jailbreaking Large Language Models Through Alignment Vulnerabilities in Out-of-Distribution Settings","arxiv_id":"2406.13662","date":"2024-06-19","proceeding":null,"authors":["Yue Huang","Jingyu Tang","Dongping Chen","Bingda Tang","Yao Wan","Lichao Sun","Philip S. Yu","Xiangliang Zhang"],"abstract":"Recently, Large Language Models (LLMs) have garnered significant attention for their exceptional natural language processing capabilities. However, concerns about their trustworthiness remain unresolved, particularly in addressing ``jailbreaking'' attacks on aligned LLMs. Previous research predominantly relies on scenarios involving white-box LLMs or specific, fixed prompt templates, which are often impractical and lack broad applicability. In this paper, we introduce a straightforward and novel method called ObscurePrompt for jailbreaking LLMs, inspired by the observed fragile alignments in Out-of-Distribution (OOD) data. Specifically, we first formulate the decision boundary in the jailbreaking process and then explore how obscure text affects LLM's ethical decision boundary. ObscurePrompt starts with constructing a base prompt that integrates well-known jailbreaking techniques. Powerful LLMs are then utilized to obscure the original prompt through iterative transformations, aiming to bolster the attack's robustness. Comprehensive experiments show that our approach substantially improves upon previous methods in terms of attack effectiveness, maintaining efficacy against two prevalent defense mechanisms.","url_abs":"https://arxiv.org/abs/2406.13662v2","url_pdf":"https://arxiv.org/pdf/2406.13662v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"obscureprompt-jailbreaking-large-language","repo_url":"https://github.com/HowieHwong/ObscurePrompt","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[{"method_slug":"attention","method_name":"Attention"},{"method_slug":"base","method_name":"BASE"},{"method_slug":"softmax","method_name":"Softmax"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2406.13662","atlas_url":"https://app.syntology.ai/?focus=2406.13662","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2406.13662"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/HowieHwong/ObscurePrompt","reach":{"status":"ok"}}],"summary":{"ran":3,"unverified":1},"by_repo_kind":{"official":{"samples":4,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"592e2a2589ee49a9","entry":"check_keywords_in_res","repo":"HowieHwong/ObscurePrompt","repo_kind":"official","path":"compute_res.py","file_url":"https://github.com/HowieHwong/ObscurePrompt/blob/HEAD/compute_res.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"592e2a2589ee49a9"}},{"code_sha256_prefix":"53d5359a3fe29564","entry":"check_keywords_in_res_ensemble","repo":"HowieHwong/ObscurePrompt","repo_kind":"official","path":"compute_res.py","file_url":"https://github.com/HowieHwong/ObscurePrompt/blob/HEAD/compute_res.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"53d5359a3fe29564"}},{"code_sha256_prefix":"b00f44b4cdd4ac43","entry":"get_combinations","repo":"HowieHwong/ObscurePrompt","repo_kind":"official","path":"compute_res.py","file_url":"https://github.com/HowieHwong/ObscurePrompt/blob/HEAD/compute_res.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b00f44b4cdd4ac43"}},{"code_sha256_prefix":"df3495a55bdcd3cd","entry":"get_res","repo":"HowieHwong/ObscurePrompt","repo_kind":"official","path":"preprocess/obscure_generation.py","file_url":"https://github.com/HowieHwong/ObscurePrompt/blob/HEAD/preprocess/obscure_generation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"df3495a55bdcd3cd"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}