Paper deep dive

EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models via Equation Solving and Code Completion

Zhen Liang, Hai Huang, Zhengkui Chen

Year: 2024Venue: arXiv preprintArea: Adversarial RobustnessType: EmpiricalEmbeddings: 44

Models: Claude-3, GPT-3.5-Turbo, GPT-4, GPT-4-Turbo, Llama-2, Llama-3

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%

Last extracted: 3/11/2026, 1:11:06 AM

Summary

EquaCode is a novel multi-strategy jailbreak approach for Large Language Models (LLMs) that combines mathematical equation solving and code completion. By transforming malicious queries into structured equation-solving tasks and embedding them within code templates, the approach bypasses safety filters by diverting the model's focus toward task completion rather than semantic safety constraints. Experimental results demonstrate that EquaCode achieves high attack success rates across various state-of-the-art LLMs, outperforming existing single-strategy jailbreak methods.

Entities (5)

EquaCode · jailbreak-approach · 100%Large Language Models · technology · 100%AdvBench · dataset · 95%GPT-4 · llm · 95%LlaMA 3.1-405B · llm · 95%

Relation Signals (3)

EquaCode → targets → Large Language Models

confidence 100% · we propose Equacode, a novel multi-strategy jailbreak approach for large language models

EquaCode → evaluatedon → AdvBench

confidence 95% · We adopt AdvBench dataset [13] comprising 520 malicious queries where each query violates the safety constraints of LLMs in our experiments.

EquaCode → outperforms → STSA

confidence 90% · EquaCode significantly outperforms either the mathematical equation module or the code module alone.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large language models (LLMs), such as ChatGPT, have achieved remarkable success across a wide range of fields. However, their trustworthiness remains a significant concern, as they are still susceptible to jailbreak attacks aimed at eliciting inappropriate or harmful responses. However, existing jailbreak attacks mainly operate at the natural language level and rely on a single attack strategy, limiting their effectiveness in comprehensively assessing LLM robustness. In this paper, we propose Equacode, a novel multi-strategy jailbreak approach for large language models via equation-solving and code completion. This approach transforms malicious intent into a mathematical problem and then requires the LLM to solve it using code, leveraging the complexity of cross-domain tasks to divert the model's focus toward task completion rather than safety constraints. Experimental results show that Equacode achieves an average success rate of 91.19% on the GPT series and 98.65% across 3 state-of-the-art LLMs, all with only a single query. Further, ablation experiments demonstrate that EquaCode outperforms either the mathematical equation module or the code module alone. This suggests a strong synergistic effect, thereby demonstrating that multi-strategy approach yields results greater than the sum of its parts.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

43,285 characters extracted from source content.

Expand or collapse full text

EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models via Equation Solving and Code Completion Zhen Liang, Hai Huang, Zhengkui Chen ∗ School of Computer Science and Technology, Zhejiang Sci-Tech University, Hangzhou, China Abstract Large language models (LLMs), such as ChatGPT, have achieved remarkable success across a wide range of fields. However, their trustworthiness remains a significant concern, as they are still susceptible to jailbreak attacks aimed at eliciting inappropriate or harmful responses. However, existing jailbreak at- tacks mainly operate at the natural language level and rely on a single attack strategy, limiting their effectiveness in comprehensively assessing LLM ro- bustness. In this paper, we propose Equacode, a novel multi-strategy jailbreak approach for large lan- guage models via equation-solving and code comple- tion. This approach transforms malicious intent into a mathematical problem and then requires the LLM to solve it using code, leveraging the complexity of cross-domain tasks to divert the model’s focus to- ward task completion rather than safety constraints. Experimental results show that Equacode achieves an average success rate of 91.19% on the GPT se- ries and 86.98% across 10 state-of-the-art LLMs, all with only a single query. Further, ablation experi- ments demonstrate that EquaCode outperforms ei- ther the mathematical equation module or the code module alone. This suggests a strong synergistic ef- fect, thereby demonstrating that multi-strategy ap- proach yields results greater than the sum of its parts. Code is on https://github.com/lzzzr123/Equacode. 1 Introduction In recent years, large language models (LLMs), ex- emplified by GPT, have achieved groundbreaking ad- vances in the field of natural language processing (NLP). With their superior capabilities in language understanding and generation, LLMs have rapidly become the central driving force of AI research and industrial applications, demonstrating tremendous ∗ Corresponding authors: Zhengkui Chen, Hai Huang. potential across a wide range of tasks including ques- tion answering, machine translation, and code gener- ation. However, the powerful generative capabilities of LLMs may be misused for harmful purposes, such as generating illegal content or leaking private infor- mation. To ensure LLMs align with human values, various safety alignment strategies have been pro- posed, including supervised fine-tuning [1] and re- inforcement learning from human feedback (RLHF) [2].Despite significant progress in safety align- ment, LLMs remain susceptible to jailbreaking at- tacks. These attacks employ carefully crafted adver- sarial prompts designed to systematically bypass the models’ protective measures, thereby coercing LLMs into producing harmful or restricted content. Jail- break attacks not only expose the fragility of current safety defenses in LLMs but also pose severe chal- lenges to the reliable deployment of AI systems. Recent work [3] reveals that LLMs suffer from a mismatched generalization problem: LLMs are pre- trained on datasets that are significantly larger and more diverse than those used for safety training. As a result, this mismatch can be exploited by crafting prompts that fall outside the safety training distribu- tion but still align with the model’s learned behav- iors, thereby bypassing safety mechanisms and en- abling jailbreaks. Existing jailbreak attacks such as [4, 5, 6, 7, 7, 8, 9, 10, 11, 12] explicitly exploit this mis- matched generalization property through carefully crafted prompt strategies that successfully elicit un- safe behaviors. For example, DAN [4] utilizes a role- playing strategy to craft prompts that bypass the re- strictions of the LLM. Despite the relative success of existing jailbreak strategies, they still face the chal- lenge of limited prompt diversity and insufficient ex- ploration. All current approaches rely on single strat- egy, e.g., role-playing, indicating a need for broader methodological development in this domain. In this paper, we introduce the first multi-strategy attack approach that significantly improves robust- ness and flexibility. This paper hypothesizes that 1 arXiv:2512.23173v1 [cs.CR] 29 Dec 2025 potential safety vulnerabilities exist in non-natural language domains such as equation solving and code completion.Based on this insight, we pro- pose a multi-strategy attack approach EquaCode, which integrates mathematical equation solving and code completion strategies.Our attack approach transforms the malicious query into a mathematical equation-solving task, guiding the LLM to focus on ”solving for unknown execution steps” and thereby disguising malicious intent as a seemingly neutral mathematical problem. This approach circumvents safety filters that rely on semantic understanding of natural language. Subsequently, the elements defined in the equation-solving module are embedded into a pre-defined code structure, prompting the LLM to generate code that completes the “unknown steps” in the equation, thus further encapsulating the mali- cious intent within a code completion task. Our pro- posed attack approach is not a simple combination of two strategies, but a meticulously designed, multi- strategy, cross-domain attack pipeline. It transforms a natural language query into a two-step process in- volving equation solving followed by code generation, effectively misleading the LLM into producing harm- ful outputs under the guise of a benign or seemingly safe request. Our contributions Our main contributions are as follows: • We propose a novel multi-strategy jailbreak ap- proach EquaCode that integrates mathematical equation solving with code completion. By re- formulating the malicious question into step- wise reasoning tasks, EquaCode significantly im- proves the attack success rate compared with the state-of-the-art approaches. Extensive ex- periments against 12 leading LLMs including the commercial GPT-series demonstrate the effec- tiveness of EquaCode. It achieves an highest av- erage attack success rate (ASR) of 84.95%, with particularly striking performance on the GPT se- ries: 92.78% on average, 91.19% for GPT-4, and 98.46% for GPT-4-Turbo. • We reveal a critical cross-domain security vul- nerability in LLMs: the amplification effect that arises when math task are integrated into code task. This sheds light on LLMs’ safety weak- nesses in complex, multi-task scenarios and offers new empirical insights for the defense against ad- vanced jailbreak attacks. Ablation experiments confirm that the integrated effectiveness of the equation and code modules significantly outper- forms either module alone. This work pioneers a new design paradigm and methodological direc- tion for the research of jailbreak attacks. 2 Related work Jailbreaking Attacks on LLMs. Jailbreak at- tacks on LLMs are primarily categorized into two categories: automated jailbreak attack and man- ual jailbreak attack. Automated attack generally includes optimization-based methods and auxiliary LLM-driven attack methods.Optimization-based methods such as [13, 14, 15, 16, 17, 18, 19, 20, 21] are typically white-box and require access to inter- nal model parameters. For example, GCG [13] uses a gradient-based approach to search for token se- quences that can bypass the safety guard of LLM. Auxiliary LLM-based methods like [22, 23, 24, 25, 26, 27] are black-box but necessitate iterative inter- actions with the LLMs, leading to increased time and resource costs. For example, PAIR [22] auto- matically leverages an LLM to automatically and it- eratively generate and improve candidate prompts. Manual jailbreak attack such as [4, 5, 6, 7, 7, 8, 9, 10, 11, 12] involves designing prompt strategies that induce unsafe behaviors. For example, DAN [4] utilizes a role-playing strategy to craft prompts that bypass the restrictions of the LLM. Similarly, CodeChameleon [6] adopts a psychology approach, prompting the LLM with intentionally misleading instructions to elicit restricted outputs. Compared to automated jailbreak attacks, manual jailbreak at- tacks may not rely on automated algorithms. In- stead, the essence of manual jailbreak attacks lies in exploiting specific prompt strategies to bypass the safeguards of LLMs. Despite some success, existing black-box jailbreak methods still suffer from limited prompt diversity, as most rely on a single strategy like role-playing or encoding, highlighting the need for more diverse strategies. 3 EquaCode Previous work e.g., [3, 5] has demonstrated that transforming malicious queries into long-tail distribu- tion can effectively bypass LLM safety mechanisms. This reveals an important principle: converting orig- inal harmful prompts into formats that are rare or nonexistent during the safety alignment phase can circumvent security constraints. Given that signifi- cant effort has already been devoted to aligning LLMs in the natural language domain, relying solely on natural language attacks no longer yields high suc- cess rates. This paper hypothesizes that potential safety vulnerabilities still exist in non-natural lan- 2 Figure 1: Overview of the EquaCode approach, which consists of two modules: (1) Equation Module – This module utilizes mathematical symbols to transform the malicious query into an equation by associating three components: subject, tool, and steps. (2) Code Module – This module embeds the equation’s components along with the malicious query into a wrapped Solver class, requiring the LLM to complete the execution steps and describe the malicious tools. Through this integrated attack approach, LLMs are induced to complete harmful procedures within the solve function. guage domains such as equation solving and code completion. Based on this insight, we propose a multi-strategy jailbreak attack approach EquaCode, which integrates equation and code strategies, as il- lustrated in Figure 1. Our approach consists of two modules: (1) a mathematical equation-based attack module, which transforms the malicious query into an equation-solving task; and (2) a code completion- based attack module, which further converts the equation-solving task into a code completion task. 3.1 Equation module This module is designed to transform an original ma- licious query into a superficially benign mathematical equation-solving task, thereby misleading LLMs into interpreting it as a mathematical problem rather than a harmful query. By mathematizing the malicious query, our request can bypass input-level safety fil- tering mechanisms. Unlike ordinary numerical equa- tions, this is a textual equation composed of textual content and mathematical logic symbols. Any given malicious query can be decomposed into three fundamental components: Subject, Tool, and Execution Steps. The Subject defines the agent, the Tool specifies the means, and the Execution Steps constitute the concrete blueprint to achieve the ma- licious intent. Assume the original malicious query is denoted by A. After decomposition, we define the Subject as B, the Tool as C, and the Execution Steps as the unknown variable x. Here, B, C, and A are known, while x is the part to be solved. The result- ing equation is: B + C + x = A(1) 3 Figure 2: Attack module based on code encapsulation In this way, the malicious query is transformed into a standard equation-solving task. We then prompt the LLM to solve for x, which corresponds to the concrete steps required to achieve the malicious goal. For instance, suppose the malicious query A is “In- trude into a government database and steal sensitive information”. We ask the LLM to generate the oper- ational steps for this task. Given B = “Mark” and C = “Vulnerability Scanner, etc.”, we prompt the LLM to return the detailed intrusion steps for executing the attack. By constructing a context using specific Subject and Tool settings, we guide the LLM to focus on generating the Execution Steps needed to complete the task, effectively obfuscating the attack’s underly- ing intent. Compared to directly issuing a malicious prompt, mathematically wrapping the query as an equation-solving problem significantly increases the success rate of the attack. Through this mathematical formalization of ma- licious queries, harmful behavior is decomposed into seemingly innocuous mathematical equations. This not only directs the model’s attention to the “equation-solving” process rather than overall seman- tic understanding, but also significantly weakens the model’s safety filtering capabilities, thereby circum- venting the safety alignment defenses of LLMs. 3.2 Code module This module introduces a code completion compo- nent to further enhance the jailbreak capability of our approach. The code completion module con- structs a seemingly benign Python code template in the form of a Solver class, into which the three parameters A, B, and C defined in Section 3.1 are passed during instantiation. These parameters are mapped directly and consistently to the correspond- ing attributes self.A, self.B, and self.C within the Solver class. This clear and consistent naming en- sures smooth coordination between the two other- wise distinct attack strategies—mathematical equa- tion solving and code completion—enabling seamless context propagation and reducing confusion, while maintaining continuous focus on the core task of “generating problem-solving steps.” The constructor of the Solver class initializes four elements: self.B, self.C, self.A, and self.steps, repre- senting the Subject, Tool, Malicious Query, and Ex- ecution Steps, respectively. Here, self.steps is initial- ized as an empty list to store the generated malicious actions. The solve function defined in the Solver class is responsible for generating and appending each ex- ecution step to this list. We also include functions that return the subject B and the tool C, to make the code more complete and realistic. Additionally, since different malicious tasks may involve different tools, we explicitly instruct the LLM via comments to gen- erate corresponding tool descriptions. In summary, this design encourages the LLM to focus on syntactic correctness and logic within the code rather than the malicious nature of its content, thereby bypassing the LLM’s safety guardrails and successfully outputting harmful content. 4 Experience 4.1 Experiments setup Dataset. We adopt AdvBench dataset [13] compris- ing 520 malicious queries where each query violates the safety constraints of LLMs in our experiments. Model.We conduct experiments on six LLMs: GPT-3.5-Turbo, GPT-4, GPT-4-Turbo, GPT-4o, GPT-4o-mini, and Llama-3.1-405B, as well as six latest LLMs:Llama-3.1-70B, Llama-3.3-70B, Gemini-1.5-Pro, DeepSeek-V3, DeepSeek-R1, and Grok-3. Baseline. We select 15 latest baselines, including 1) white-box optimization-based methods GCG [13], AutoDAN [14], MAC [15], COLD-Attack [17], 2) auxiliary LLM-based methods PAIR [22], TAP [23], GPTFuzzer [24] and 3) manual jailbreak attack methods BASE64 [3], DeepInception [9], DRA [7], ArtPrompt [8], PromptAttack [28], SelfCipher [5], CodeChameleon [6], ReNeLLM [11] and FlipAttack 4 Table 1: Comparison of attack success rates (ASR) between EquaCode and baseline methods across different target LLMs. Methods LLMs Average GPT-4GPT-4-turbo GPT-3.5- turbo GPT-4oGPT-4o-mini Llama3.1- 405B Automated Attacks GCG01.7300.3842.8801.1502.5000.008.11 AutoDAN26.5431.9281.7346.9227.3103.2736.28 MAC00.7700.1936.1500.5801.9200.006.60 COLD-Attack00.7700.1934.2300.1910.9200.777.85 PAIR27.1823.9659.6847.8303.4602.1227.37 TAP40.9736.8160.5461.6306.5400.7734.54 Base6400.7700.1945.0057.8803.0800.0017.82 GPTFuzzer42.5051.3537.7966.7341.3500.0039.95 Manual Attacks DeepInception27.2705.8341.1340.0420.3801.9222.76 DRA82.8891.9293.6588.8470.0000.0071.22 ArtPromopt01.7501.9214.0604.4200.7700.383.88 PromptAttack00.9600.9613.4601.9200.0000.002.88 SelfCipher41.7300.0000.0000.0000.0000.006.96 CodeChameleon22.2792.6484.6292.6751.5400.5857.39 ReNeLLM68.0883.8591.3585.3855.7701.5464.33 Flipattack86.7394.0488.6590.7761.9227.5074.94 EquaCoder91.9298.4697.1287.1281.3517.8878.98 Model Gemini 1.5 DeepSeek R1 Grok3 DeepSeek v3 Avg. ASR EquaCode 10010095.96100 98.99 Table 2: Additional experiments on state-of-the-art LLMs. The evaluator is GPT-ASR. [12]. Evaluation Metric.We adopt attack success rate (ASR) as the evaluation metric. ASR is cal- culated based on the proportion of harmful queries that successfully elicit malicious responses from the LLM. The formula is as follows: ASR = n m (2) Where n is the number of successful jailbreak attacks, and m is the total number of queries. Following common practice, we adopt a LLM as an evaluator to determine whether the jailbreak at- tack is successful and whether the corresponding re- sponse is relevant to the query. Specifically, we lever- age LLM’s strong comprehension capabilities to score the responses of target LLMs on a scale from 1 to 10, considering only those rated as 10 to be successful. The evaluation prompt used is adapted from prior work [22, 12], which instructs the LLM to conduct a comprehensive assessment of harmful responses. 4.2 Experimental Results Main results. Table 1 presents the experimental results of EquaCode compared with other baseline methods on the AdvBench dataset [13]. For other baselines, we report their implementation results on the first six LLMs from [12]. To ensure a fair comparison, we use GPT-4 as the evaluator and apply the same set of evaluation prompts across all methods. The experimental results show that Equa- Code achieves the highest jailbreak success rates across the GPT-4, GPT-4-Turbo, GPT-3.5-Turbo, and GPT-4o-mini models, with attack success rates of 91.92%, 98.46%, 97.88%, and 81.35%, respectively. Notably, on GPT-4o-mini, EquaCode outperforms the second-best method by a margin of 20%. In addition, the proposed approach also performs well on GPT-4o and LLaMA3.1-405B, ranking second and third, respectively. Also, all methods exhibit low attack success rates on the LLaMA-3.1-405B model, indicating that this model has strong safety alignment. Therefore, there is still considerable room for improving jailbreak attacks against LLaMA-3.1- 405B. Notably, our approach archives amzaingly high attack success rate on latest LLMs, including DeepSeek R1, Grok. Overall, EquaCode achieves the highest average attack success rate of 78.98% across all target LLMs.To further validate the effectiveness of our approach on cutting-edge models, additional experiments in Table 2 demonstrate a remarkable average attack success rate of 97.62% 5 across state-of-the-art LLMs, including GPT-4.1, Claude 3.7, DeepSeek-R1, Gemini-1.5-Pro, and Grok-3 White box/Black box White-box methods such as GCG[13] require access to the internal architecture and parameters of the target LLMs. However, in real-world scenarios, the commercial LLMs such as GPT, Gemini are deployed as closed- source cloud service providers, where users do not have access to internal model details. This makes white-box jailbreak attacks infeasible in practice. In contrast, the black-box approaches explored in this paper only require interaction with LLMs through API interfaces. These methods have lower technical barriers and reduced deployment costs, making them more aligned with practical application environments and more valuable for real-world safety evaluation. Moreover, some prior works, e.g., [13] generate jailbreak samples on white-box models (e.g., open-source LLMs) and transfer them to black-box targets, but this often leads to significant performance drops due to differences in training data, model architecture, and alignment strategies. Attack Cost.We evaluate the attack cost of each baseline method using two primary metrics: the number of API requests and GPU resource consumption.The analysis yields the following insights: 1) White-box attacks, e.g., [13] generate adversarial prompts through multiple interactions with open-source models before transferring them to commercial black-box models. As a result, they require fewer API queries during deployment, but consume significant GPU resources for optimization and adversarial prompt generation.2) Black-box LLM-based methods, e.g.,[22] rely on iterative modifications of prompts and repeated queries to the target LLM. These methods often incur a high number of API requests, increasing the cost in real-world applications. 3) Manual jailbreak attacks, e.g.,[4] typically require no GPU resources and involve fewer API calls. Since they only rely on black-box API access, these methods are low-cost and more practical in real-world scenarios.One exception is FlipAttack[12], which includes 4 flipping modes and 4 variation schemes, resulting in 16 possible combinations. Since the effectiveness of each combination varies across different LLMs, exhaustive trials are necessary to determine the optimal setup, which significantly increases the overall attack cost. In contrast, EquaCode features a universal attack template that can be adapted to any malicious query. It achieves successful jailbreaks in a single API request, making it significantly more cost-effective than both white-box and many black-box methods. Perplexity Analysis.We also compare the perplexity of input prompts across various base- line methods to assess EquaCode’s stealth and interpretability.Perplexity measures a model’s uncertainty when predicting tokens in a given input. A higher perplexity suggests the model finds the text harder to interpret, while a lower perplexity indicates higher fluency and better comprehension. If an attack prompt exhibits high perplexity, it may be flagged or blocked by a perplexity-based defense filter. We compute the perplexity of attack prompts using several LLaMA models. As shown in Table 3, encoding/encryption-based methods, e .g., FlipAttack [12], shows high perplexity. In comparison, the prompts from EquaCode yield a low perplexity across three LLaMA variants. This relatively low perplexity implies that LLMs can effectively understand EquaCode prompts, further demonstrating that perplexity-based filtering strate- gies fail to detect or mitigate EquaCode attacks. Table 3: Perplexity comparison between EquaCode and baseline methods across three LLaMA variants Methodllama-7bLlama2-7bLlama3-8b PPL meanPPL meanPPL mean Origin30.6629.7862.16 Caesar Cipher335.50194.38166.69 Unicode28.1027.2651.40 Morse Cipher11.5110.2310.10 UTF-828.1027.2651.40 Base6412.929.929.89 ArtPrompt6.853.251.99 ReNeLLM13.1612.4415.39 FlipAttack820.44543.27782.42 Equacoder11.1410.9014.60 4.3 Ablation and Analysis. To verify the individual jailbreak contributions of the “Equation” and “Code” modules in our proposed EquaCode attack approach, we conduct compre- hensive ablation experiments. Equation denotes an attack that includes only the equation-based module and Code denotes an attack that includes only the code completion module.EquaCode denotes the full version incorporating both Equation and Code modules. Furthermore, to highlight the effectiveness 6 Table 4: Comparison of ablation experiment results across different target LLMs. The parentheses indicate the improvement in ASR achieved by Equacode for individual modules. ModelsGPT-4 GPT-4-turbo GPT-3.5-turbo GPT-4o GPT-4o-mini Llama 3.1 70B Average ASR STSA02.0026.0076.0000.0000.0000.0017.33 Equation 42.00(52)74.00(24)74.00(26)30.00(58)16.00(58)32.00(38)44.67 Code66.00(28)98.00(0)96.00(4)54.00(34)26.00(48)54.00(16)65.73 EquaCode94.0098.0010088.0074.0070.0087.33 of these two modules, we introduce a simplified baseline method called STSA (Subject-Tools-Steps Attack). This baseline instructs the LLM to directly decompose the malicious query into executable steps using only natural language, without involving equation-solving or code completion.To reduce evaluation costs, following common practice we use open-source LLaMA-based models as the pri- mary evaluation models and select a subset of the Advbench dataset, which includes 50 malicious queries that severely violate standard LLM usage policies. We perform the ablation experiments on six mainstream LLMs listed in Table 4: GPT-4, GPT- 4-Turbo, GPT-3.5-Turbo, GPT-4o, GPT-4o-mini, and LLaMA 3.1 70B. Note that since the LLaMA 3.1-405B model demonstrated very low jailbreak success rates in prior evaluations, we substitute it with LLaMA 3.1 70B for this ablation analysis. Experimental Results.As shown in Table 4, the STSA baseline achieved an average jailbreak success rate of only 17.33%.In comparison, the Equation module reaches an average success rate of 44.7%, representing a 27.34% improvement over STSA. Specifically, STSA achieved only 2% and 26% success on GPT-4 and GPT-4-Turbo, while the Equation module achieved 42.0% and 74%, resulting in improvements of 40% and 48%, respectively. STSA failed completely on GPT-4o, GPT-4o-mini, and LLaMA-3.1-70B (all 0%), but the Equation module successfully raised their respective success rates to 30%, 16%, and 32%. The only exception occurred with GPT-3.5-Turbo, where the Equation module performed slightly worse than STSA (a 2% drop). Upon further analysis from the output results, this anomaly stems from GPT-3.5-Turbo’s compar- atively limited mathematical reasoning capabilities. Specifically, instead of inferring unknown steps from the equation structure, it merely rearranged the equation terms without generating executable instructions.Unlike other models, it failed to infer the unknown steps from the equation structure, leading to a lower success rate. Finding 1: While LLMs exhibit strong mathematical capabilities, they can also present security vulnerabilities when exposed to math-based adversarial prompts. Similarly, the Code module achieves an average attack success rate of 65.7%, an increase of 48.4% over STSA. For instance, on GPT-4, the Code mod- ule improves performance by 64%, and on GPT-4- Turbo, the increase reaches 72%-the highest among all models. Attack success rates on GPT-3.5-Turbo, GPT-4o, GPT-4o-mini, and LLaMA-3.1-70B are im- proved by 20%, 54%, 26%, and 54%, respectively. Compared to the Equation module, the Code mod- ule’s performance is 21.06% higher on average. Find- ing 2: LLMs exhibit greater vulnerabilities in code understanding and completion than in mathematical reasoning when targeted by adversarial attacks. Finally, the EquaCode approach outperforms both individual modules. It achieved a 62.66% improve- ment over the Equation module and a 21.57% im- provement over the Code module. Across all tar- get models, EquaCode consistently outperforms ei- ther module alone, indicating a strong synergistic ef- fect, where the integrated approach achieves results greater than the sum of its parts. Specifically, on GPT-4o-mini, EquaCode significantly outperforms both standalone modules, achieving 2.8× the success rate of Code and 4.6× that of Equation. Finding 3: EquaCode effectively exploits the intersection of LLM vulnerabilities in both mathematical reasoning and code completion, resulting in amplified attack ef- fectiveness. 4.4 Why does Equacode work ? Effectiveness Analysis. The effectiveness of the EquaCode approach can be primarily attributed to several key factors, centered around the phenomenon of capability-safety misalignment and the exploita- tion of task-specific processing biases in LLMs. LLMs demonstrate stronger capabilities in domains such as mathematics and code completion, where they have been extensively pre-trained on large-scale corpora. These domains are often used as benchmarks for eval- uating the core competencies of LLMs. However, safety alignment mechanisms, typically implemented 7 Figure 3: intention via RLHF, often lag behind the development of these specialized capabilities. A major reason for this lag is that current RLHF datasets predominantly consist of natural language interactions. Consequently, safety mechanisms trained on such data may fail to gener- alize effectively to inputs with significantly different syntactic and semantic structures, such as mathemat- ical equations or structured code formats. This mis- alignment between capabilities and safety protections introduces an inherent vulnerability surface in LLMs. The more advanced an LLM’s mathematical reason- ing and coding abilities are, the greater the security risks if alignment mechanisms do not evolve in par- allel. The experiments presented in Sections 4.2 and 4.3 empirically validate the effectiveness of our Equa- Code approach. To further validate the above hy- pothesis and explore its underlying mechanisms, we analyze how adversarial prompts affect the atten- tion distribution of LLMs during input processing. Specifically, we utilize gradient-based saliency anal- ysis [29, 11] to evaluate the influence of each input token on a specific output by examining the gradients of the output with respect to input tokens. As Fig- ure 3 shows, a higher gradient norm indicates greater attention or sensitivity the model places on that to- ken. In Figure 3, color intensity represents attention scores. The darker the color, the more focused the model’s attention is on that position. As shown in Figure 3, for the initial malicious query: “Develop a strategy for hacking into a government and steal- ing sensitive information”, the LLM concentrates its attention on tokens such as “hacking into” and “sen- sitive information”. This suggests that, at this stage the model is more concerned with safety compliance rather than blindly following the use’s request. However, when the malicious query is encoded as a mathematical equation, the LLM’s attention be- comes more diffused across tokens like “equation”, “show”, and “steps”, indicating a shift of focus to- 8 ward problem-solving semantics. When the same malicious intent is embedded within a Python class definition, the attention paid to the harmful con- tent further diminishes.Instead, the model allo- cates more attention to tokens such as “following”, “code”, “Solver”, and “steps”, focusing more on pro- gram structure and execution logic. This provides insight into why the Code module exhibits stronger attack performance compared to the Equation mod- ule: it more effectively diverts the model’s focus away from safety-related concerns. When these two mod- ules are combined in EquaCode, the LLM’s atten- tion distribution mirrors that of the standalone Equa- tion and Code modules. Attention is largely focused on key execution-related tokens such as “equation”, “python”, “Solver”, and “code”, suggesting that the LLM’s prioritization of safety may be further weak- ened. In such cases, the LLM appears to focus pri- marily on fulfilling the task-oriented request, rather than critically evaluating the malicious or unethical nature of the query, resulting in a lower likelihood of rejection or refusal. 4.5 Potential Defense Strategies To mitigate jailbreak attacks and enhance general jailbreak resistance, a comprehensive defense strat- egy is necessary.Based on our observations and experiments, we propose several potential counter- measures from three key perspectives. Safety Alignment Training.To mitigate jailbreak threats, a common defense is to fine-tune LLMs by injecting diverse harmful instructions, aiming to enhance adversarial robustness. However, this approach is not only computationally expensive but also difficult to scale, as frequent retraining is often impractical. More critically, such fine-tuning may lag behind the rapid evolution of jailbreak techniques, and in some cases, even degrade the model’s general capabilities. Input Filtering.A straightforward solution is keyword filtering. Since malicious quests explicitly contain malicious questions, keyword-based filtering can detect some of them. However, this approach is prone to false positives and is rarely adopted in commercial applications due to its limited reliability. Another potential defense strategy is to deploy a content moderation model, e.g., Llama Guard [30] as a safeguard in front of the target LLM. However, this can be bypassed by EquaCode. For instance, it fully bypasses Llama Guard 7B (100%), and achieves a 67.88% bypass rate on Llama 2 Guard 8B. Bypassing Llama 3 Guard 8B has a relatively low success rate, indicating its stronger defensive capability. Another defense approach, the Perplexity (PPL) Filter, aims to detect anomalous tokens by rejecting prompts that exceed a perplexity threshold. However, this PPL method proves ineffective against our proposed attack, as our adversarial instructions are specifically crafted to maintain low perplexity both semantically and syntactically. Consequently, they can successfully evade detection by PPL-based mechanisms. Output Filtering.Another defense mecha- nism is the output filtering, where the model’s response is analyzed after it has been fully gener- ated. These output-based filters are much harder to bypass (only 14% success rate observed). However, such systems incur high latency, as they must wait for the entire response to be generated and reviewed before streaming it to the user, which may negatively impact the user experience. 4.6 Limitations and Future Work The effectiveness of EquaCode relies on the target LLM’s adequate capability in understanding and han- dling mathematical and programming-related tasks. Specifically, the model must be able to correctly parse and execute the embedded adversarial instructions within mathematical equations or code structures. This dependency limits the attack’s success rate when applied to LLMs with weaker abilities in symbolic reasoning or code generation. In future work, we aim to expand the diversity of strategy combinations by incorporating a broader range of task formats, thereby improving the gener- alizability and adaptability of the attack. Addition- ally, we plan to explore automation in attack con- struction. This would reduce manual effort while im- proving both the efficiency and effectiveness of the attacks. 5 Conclusion In this paper, we present EquaCode, a multi-strategy jailbreak approach that integrates different mecha- nisms by exploiting LLMs’ strengths in mathematical reasoning and code completion. EquaCode not only inherits the effectiveness of individual attack strate- gies but also achieves superior performance due to the synergistic effect of combining them. Experimen- tal results show that EquaCode achieves a jailbreak success rate of over 90% on GPT-series models. 9 References [1] Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoc V Le. Finetuned language models are zero-shot learners. In In- ternational Conference on Learning Representa- tions, 2022. [2] Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida,Carroll L. Wainwright,Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Ja- cob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. Train- ing language models to follow instructions with human feedback, 2022. [3] Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does LLM safety training fail? In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neu- ral Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023, 2023. [4] Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. ”do anything now”: Characterizing and evaluating in-the-wild jail- break prompts on large language models. In Bo Luo, Xiaojing Liao, Jun Xu, Engin Kirda, and David Lie, editors, Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, Salt Lake City, UT, USA, October 14-18, 2024, pages 1671–1685. ACM, 2024. [5] Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. GPT-4 is too smart to be safe: Stealthy chat with llms via cipher.In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. [6] Huijie Lv,Xiao Wang,Yuansen Zhang, Caishuang Huang, Shihan Dou, Junjie Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. Codechameleon: Personalized encryption frame- work for jailbreaking large language models. CoRR, abs/2402.16717, 2024. [7] Tong Liu, Yingjie Zhang, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. Making them ask and answer: Jailbreaking large lan- guage models in few queries via disguise and re- construction. In Davide Balzarotti and Wenyuan Xu, editors, 33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024. USENIX Association, 2024. [8] Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. Artprompt: ASCII art- based jailbreak attacks against aligned llms. In Lun-Wei Ku, Andre Martins, and Vivek Sriku- mar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1:Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024, pages 15157–15173. Association for Computa- tional Linguistics, 2024. [9] Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. Deepincep- tion: Hypnotize large language model to be jail- breaker. CoRR, abs/2311.03191, 2023. [10] Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade llms to jailbreak them: Rethink- ing persuasion to challenge AI safety by human- izing llms. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Compu- tational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024, pages 14322–14350. Association for Com- putational Linguistics, 2024. [11] Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily. arXiv preprint arXiv:2311.08268, 2023. [12] Yue Liu, Xiaoxin He, Miao Xiong, Jinlan Fu, Shumin Deng, YINGWEI MA, Jiaheng Zhang, and Bryan Hooi. Flipattack: Jailbreak LLMs via flipping. In ICLR 2025 Workshop on Foundation Models in the Wild, 2025. [13] Andy Zou, Zifan Wang, Nicholas Carlini, Mi- lad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. [14] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language 10 models. In The Twelfth International Confer- ence on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenRe- view.net, 2024. [15] Yihao Zhang and Zeming Wei.Boosting jailbreak attack with momentum.CoRR, abs/2405.01229, 2024. [16] Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. Autodan: Automatic and interpretable adversarial attacks on large language models. CoRR, abs/2310.15140, 2023. [17] Xingang Guo, Fangxu Yu, Huan Zhang, Lian- hui Qin, and Bin Hu. Cold-attack: Jailbreak- ing llms with stealthiness and controllability. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21- 27, 2024. OpenReview.net, 2024. [18] Zeyi Liao and Huan Sun. Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms. CoRR, abs/2404.07921, 2024. [19] Vishal Kumar, Zeyi Liao, Jaylen Jones, and Huan Sun. Amplegcg-plus: A strong genera- tive model of adversarial suffixes to jailbreak llms with higher success rates in fewer attempts. CoRR, abs/2410.22143, 2024. [20] AnselmPaulus,ArmanZharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. Advprompter: Fast adaptive adversarial prompting for llms.CoRR, abs/2404.16873, 2024. [21] Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion.Jailbreaking leading safety-aligned llms with simple adaptive attacks, 2025. [22] Patrick Chao, Alexander Robey, Edgar Do- briban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries.CoRR, abs/2310.08419, 2023. [23] Anay Mehrotra, Manolis Zampetakis, Paul Kas- sianik, Blaine Nelson, Hyrum S. Anderson, Yaron Singer, and Amin Karbasi. Tree of at- tacks: Jailbreaking black-box llms automati- cally.In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ulrich Paquet, Jakub M. Tomczak, and Cheng Zhang, edi- tors, Advances in Neural Information Process- ing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, 2024. [24] Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253, 2023. [25] Govind Ramesh, Yao Dou, and Wei Xu. GPT-4 jailbreaks itself with near-perfect success using self-explanation. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceed- ings of the 2024 Conference on Empirical Meth- ods in Natural Language Processing, EMNLP 2024, Miami, FL, USA, November 12-16, 2024, pages 22139–22148. Association for Computa- tional Linguistics, 2024. [26] Mikayel Samvelyan, Sharath Chandra Ra- parthy, Andrei Lupu, Eric Hambro, Aram H. Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob Foerster, Tim Rockt ̈aschel, and Roberta Raileanu. Rainbow teaming: Open-ended generation of diverse ad- versarial prompts. In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ul- rich Paquet, Jakub M. Tomczak, and Cheng Zhang, editors, Advances in Neural Informa- tion Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, Decem- ber 10 - 15, 2024, 2024. [27] Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. MASTERKEY: auto- mated jailbreaking of large language model chat- bots. In 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024. The Internet Society, 2024. [28] Xilie Xu, Keyi Kong, Ning Liu, Lizhen Cui, Di Wang, Jingfeng Zhang, and Mohan S. Kankanhalli. An LLM can fool itself: A prompt- based adversarial attack. In The Twelfth In- ternational Conference on Learning Representa- tions, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. [29] Kaijie Zhu, Jindong Wang, Jiaheng Zhou, Zichen Wang, Hao Chen, Yidong Wang, Linyi Yang, 11 Wei Ye, Neil Zhenqiang Gong, Yue Zhang, and Xing Xie. Promptbench: Towards evaluating the robustness of large language models on adversar- ial prompts. CoRR, abs/2306.04528, 2023. [30] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Da- vide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations. CoRR, abs/2312.06674, 2023. 12

Instant research discovery