Random Character-Level Perturbations Amplify LLM Jailbreak Attacks

Shuyi Yu Zhe Cao Kohei Tsuji Yusuke Sakai Hidetaka Kamigaito Jingun Kwon Manabu Okumura Taro Watanabe

2026 · Trans. Mach. Learn. Res. · Vol 2026 · 1 citation

Computer Science

TL;DR

This work finds that models cannot reliably reconstruct the original meaning and layer-wise probe classifiers fail to detect the harmful intent of perturbed prompts, and perturbations can occasionally reduce attack success by inducing off-topic or incoherent responses.

Semantic Scholar

View source

Similar papers

Preprint Aug 2026

Lexical Perturbations Disrupt LLM Reasoning: An Empirical Study of Attention Diversion

Attention Diversion explains why inference-time strategies, including chain-of-thought prompting, spell-checking, self-repair, and stronger repair models, fail to consistently recover performance: each addresses one channel at a time.

Jiaqi Zhu, Yang Zhang, Jun-Hua Ding et al. · 0 citations

Sep 2026

IC-GCG: Jailbreaking Large Language Models via Intermediate Consistency Optimization

Recent jailbreak attacks demonstrate that large language models (LLMs) can be manipulated to generate harmful outputs through adversarial prompts even after robust alignment. However, prevailing methods typically focus on forcing a desired response at the output layer—a surface-level strategy that is brittle and often...

Zichu Ren, Donghai Zhu, Haibo Hong et al. · IEEE Internet of Things Jour... · 0 citations

Preprint Aug 2026

Unveiling Spectral Mechanisms in Training-Free LLM Text Detection

It is shown that the strength of this signal depends on text length and sampling range: spectral evidence is clearest for long, continuous, constrained generation, while short, fragmented, mixed, and edited settings require complementary confidence and fluctuation views.

Haitong Luo, Xuying Meng, Wei-Yao Zhang et al. · 1 citation

Conference Open access 2026

TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models

This work proposes TinyAttack, a novel adversarial attack framework designed to exploit vulnerabilities in LLMs through Unicode-based stylistic transformations, which utilises five Unicode variants to modify the visual rendering of text without altering its underlying semantic or syntactic structure.

M. Mamta, B. Grecu, O. Cocarascu · Annual Meeting of the Associ... · 0 citations

Conference Open access May 2026

Incomplete Prompt Jailbreaks in Large Language Models

This work formalizes this phenomenon as incomplete prompt jailbreaks (IPJ) and provides a systematic empirical characterization of when and how incomplete prompts elicit harmful continuations, and identifies two functional neurons: termination and continuation neurons.

Y. Kim, Bumjin Park, Jaesik Choi · Annual Meeting of the Associ... · 0 citations

Preprint Jul 2026

The Effect of Multi-Lingual and Keyword Adversarial Injection on LLM Relevance Judgment

This work investigates the impact of cross-lingual prompt injection attacks on LLM-based relevance judgments using TREC Deep Learning collections and two open-weight models under established prompting frameworks, and demonstrates that multilingual query-based injections are highly effective in inflating relevance score...

Nguyen-Thanh-Thao Vo, Duy Duong Tuong, Oleg Zendel et al. · 0 citations