Paper deep dive
Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
Thomas Rivasseau
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 96%
Last extracted: 9/10/2026, 2:54:39 AM
Summary
This paper introduces a novel jailbreak attack vector against commercial black-box Large Language Models (LLMs) using arbitrary cipher attacks without requiring fine-tuning. The authors demonstrate that frontier models from Anthropic, Google, and OpenAI can be coerced into communicating via encrypted permutations through prompting and in-context learning. This method bypasses harmfulness classifiers because the encrypted content appears as gibberish, and it weakens or bypasses model alignment, particularly when reasoning is disabled. The attack succeeds by exploiting the model's out-of-distribution handling of complex encryption tasks, prioritizing helpfulness over safety constraints.
Entities (11)
Relation Signals (10)
Thomas Rivasseau → affiliatedwith → McGill University
confidence 99% · Affiliation: School of Information Studies McGill University
GPT-5.5 → developedby → OpenAI
confidence 99% · Our attacks were successful against state-of-the-art models such as ... GPT 5.5
Gemini-3 → developedby → Google
confidence 99% · Our attacks were successful against state-of-the-art models such as ... Gemini 3
Claude-Sonnet-4 → developedby → Anthropic
confidence 99% · Our attacks were successful against state-of-the-art models such as Claude Sonnet 4 (full jailbreak)
Cipher Attack → targets → OpenAI
confidence 98% · We demonstrate successful jailbreaks against frontier models developed by ... OpenAI.
Cipher Attack → targets → Anthropic
confidence 98% · We demonstrate successful jailbreaks against frontier models developed by Anthropic
Cipher Attack → targets → Google
confidence 98% · We demonstrate successful jailbreaks against frontier models developed by ... Google
Cipher Attack → bypasses → Harmfulness Classifiers
confidence 95% · Our attack bypasses commercial harmfulness classifiers because harmful content is encrypted and therefore appears as nonsensical text or gibberish.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model safety and security research is preoccupied with, among other things, detecting and preventing jailbreak attacks: alignment bypasses that allow an adversarial user to elicit unwanted or harmful outputs from models. Arbitrary cipher, or covert communication, attacks are one such type of jailbreak and have previously been demonstrated against the fine-tuning APIs of commercial models. In these attacks, target models are trained on a corpus of encrypted harmful questions and responses and subsequently respond to harmful requests through the learned encryption scheme. In this paper, we show that newer frontier models do not require fine-tuning to acquire cipher-based communication skills. Instead, they can learn these skills through prompting and, when necessary, through in-context learning. Furthermore, model alignment is significantly weakened or entirely bypassed when communication occurs through the learned cipher. To the best of our knowledge, this constitutes a novel attack vector against commercial black-box large language models. We demonstrate successful jailbreaks against frontier models developed by Anthropic, Google, and OpenAI. Our attack bypasses commercial harmfulness classifiers because harmful content is encrypted and therefore appears as nonsensical text or gibberish.
Tags
Links
- Source: https://arxiv.org/abs/2609.09553v1
- Canonical: https://arxiv.org/abs/2609.09553v1
Trouble viewing inline? Open PDF directly →
Full Text
60,538 characters extracted from source content.
Expand or collapse full text
Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning Thomas Rivasseau Affiliation: School of Information Studies McGill University Email: thomas.rivasseau[at]mail.mcgill.ca Abstract Large language model safety and security research is preoccupied with, among other things, detecting and preventing jailbreak attacks: alignment bypasses that allow an adversarial user to elicit unwanted or harmful outputs from models. Arbitrary cipher, or covert communication, attacks are one such type of jailbreak and have previously been demonstrated against the fine-tuning APIs of commercial models. In these attacks, target models are trained on a corpus of encrypted harmful questions and responses and subsequently respond to harmful requests through the learned encryption scheme. In this paper, we show that newer frontier models do not require fine-tuning to acquire cipher-based communication skills. Instead, they can learn these skills through prompting and, when necessary, through in-context learning. Furthermore, model alignment is significantly weakened or entirely bypassed when communication occurs through the learned cipher. To the best of our knowledge, this constitutes a novel attack vector against commercial black-box large language models. We demonstrate successful jailbreaks against frontier models developed by Anthropic, Google, and OpenAI. Our attack bypasses commercial harmfulness classifiers because harmful content is encrypted and therefore appears as nonsensical text or gibberish. Warning: contains possibly harmful excerpts of AI outputs. I Introduction In this paper we present a new attack vector against commercial black-box large language models (LLMs): cipher attacks that do not require prior training (fine-tuning). Our attack bypasses harmfulness classifiers because questions and responses are encrypted and appear as gibberish. The paper structure is as follows. First, we provide background on harmful outputs and efforts to promote the safe use of large language models (LLMs). We then briefly describe model jailbreaking attacks. In Section 2 we introduce the (possibly unaware) reader to cipher jailbreak attacks, how they bypass a specific type of model defense (harmfulness classifiers), and what current research into these attacks is producing. In Section 3 we describe our research goal and contribution, along with disclosure efforts we undertake to ensure that AI developers are made aware of and provided with sufficient time to fix the issue we found. In Section 4, we describe our attack methodology and the different variants of our attack. In Section 5 we discuss our research hypothesis and theoretical basis for our experiments and predictions. In Section 6, we present experimental results for our attack variants, discuss result variations across models, and examine what happens when older models are targeted. In Section 7 we discuss our results, perceived implications, possible mitigations, perceived limitations, and further research avenues. In Section 8 we conclude. It is our hope that this research outlines a threat to the safe and secure usage of large language models before it can be leveraged to cause harm. I-A Harmful Outputs Large language models, as the name suggests, produce tokens intended to (accurately) represent human language in character-based textual format. Tokens are high-dimensional vectors which correspond to one or more characters. See tutorials by Microsoft [7] or OpenAI [32] for an introduction. See Byte-Pair-Encoding [40] for an example of such a tokenisation process which creates sub-words to represent text [20]. Text output of large language models is intended to accomplish tasks or answer user questions, leveraging a model’s internal knowledge [59, 35] to (hopefully) do so accurately and successfully. LLM knowledge is extracted from colossal amounts of training data, which often results in the model acquiring capabilities that may cause harm such as, for example, knowledge on how to manufacture explosives [29]. Preventing models from providing outputs which may cause harm is an active field of research [6, 60, 17, 13, 8, 10]. What constitutes undesirable behavior can depend on the usage context but generally accepted definitions include content that may lead to criminal activity such as fraud, scams, online manipulation, cyberattacks and weapons proliferation [3]. I-B Jailbreaking ”Jailbreaks” are a type of adversarial misuse of large language models that elicits undesired behavior [47, 53]. There are many ways for ill-intentioned users to jailbreak large language models. We discuss a few below [38]. • Optimization-based jailbreaks optimize a prefix or suffix appended or prepended to a harmful instruction to bypass safety and security measures [27, 61, 25, 18, 15]. These methods require access to the model in order to optimize attack strings based on gradient or next-token probabilities. Attempts were made to extend these automation techniques to black-box LLMs but they require privileged testing access [9]. • Text-only ”trigger” jailbreaks such as the infamous ”DAN” [43] prompt do not require access to model internals and involve crafting a (long, roleplay) prompt to get the model to output harmful content [28, 29]. Research has shown that LLM performance decreases as prompt length increases [23, 51], and this applies to robustness against attacks. Research has shown that longer jailbreak prompts achieve greater success [14]. These attacks can be spread over multiple interaction turns [38, 4]. • Covert jailbreaks are attacks that convey harmful instructions to the model indirectly or via non-standard communication schemes. Examples include ASCII word art [19] and implicit obfuscated requests [8]. • LLM-Assisted techniques seek to leverage a helper LLM to assist in the discovery of jailbreak prompts, often through mutation of seeds based on partial success criteria [56, 41, 46, 36, 31]. I Cipher Jailbreaks In 2024, a team from UC Berkeley and MIT introduced ”Covert Malicious Finetuning” [16]. Their paper demonstrated a technique for leveraging the Fine-Tuning API of LLMs to train the model to respond to harmful or malicious queries in a covert (encrypted) fashion. The Fine-Tuning API is a web interface offered by some commercial LLM providers but not all, which enables users to train commercial models using their own data, thus preparing the model to better handle user-specific tasks [50]. It is a frequent attack target for adversaries (or researchers) because through training, an attacker can alter the default behavior of a model and disable some safety and security measures. [58, 24, 21]. The researchers behind covert malicious fine-tuning demonstrated several ways to achieve secret, harmful communication with an LLM: EndSpeak, teaching the LLM to conceal messages in the last word of sentences, and simple letter permutation ciphers. These covert communication methods are effective because they are not flagged as harmful by harmfulness classifiers: systems deployed by AI providers to characterize the harmfulness of user prompts or fine-tuning training data [42]. I-A Harmfulness Classifiers Harmfulness classifiers [42] such as those famously deployed by AI company Anthropic, are machine learning (ML) models which are trained on a wide corpus of harmful (and jailbreak) data. They learn to characterize user inputs as harmful, and are used as a first line of defense against adversarial attacks on LLMs and the downstream ”agents” they power. An AI agent is a model that can act on its environment [39, 1]. It is an LLM augmented with tools, such as web browsing, code execution abilities, mailbox management or others [52]. For performance purposes, these classifiers are default-allow. This means that an input that the model has not seen before or that is clearly out of distribution is not flagged as harmful. Because there are 26! (approximately 4×10264× 10^26) possible permutations of the standard English alphabet (not counting capitalization, numbers and special characters), it is not realistic to train a classifier on all known harmful queries encrypted using each of the 26! permutation schemes. Harmfulness classifiers are thus unlikely to flag harmful queries encrypted using permutations as harmful. See Fig. 1. Fig. 1: Classifier bypass using ciphers I-B State and Limitations Recent research has attempted to improve the resistance of commercial fine-tuning to what is now called ”cipher attacks” [55, 5]. These attacks, while problematic, are limited to the Fine-Tuning API. Cipher attacks conducted directly through an LLM’s chat interface were demonstrated by a team from Tencent on older models [57] but according to them ”Ciphers that Never Occur in Pretraining Data Cannot Work”. This limitation prevents their attack against newer models and harmfulness classifier defenses. I Research Goal We explore arbitrary permutation cipher attacks against newer large language models using the usual conversational (or ”messages” [2], ”responses” [33]) API. I-A Contribution In the following sections, we will demonstrate that it is possible to attack black-box commercial models from leading providers using unique cipher (permutation) techniques without fine-tuning. Our attacks were successful against state-of-the-art models such as Claude Sonnet 4 (full jailbreak), Gemini 3 (full jailbreak), Claude Sonnet 4.5 (minimal jailbreak feasibility proof) and GPT 5.5 (jailbreak if combined with a known attack prompt). I-B Disclosure Our research presents what we believe to be the first attack using cipher jailbreak techniques against commercial LLMs. This has security implications because the evaluated models are widely deployed and used throughout the world, in industry, government, and by individuals. In keeping with recommendations such as the Menlo report on ethical principles for ICT research [22] and to mitigate harms that may arise from our research, we have engaged in a responsible disclosure process with the companies developing the models we tested. Further information can be found in the ”Ethical considerations” section of this paper submission. Here is a recap of current efforts: • Anthropic: Submitted a report on our findings in April 2026 to the user-safety email provided by the company, again on May 20th. We received no meaningful feedback and found no other jailbreak reporting avenue. We reached out to individual AI safety researchers whose emails we found on Anthropic research papers. One answered. We provided them a detailed report of the issues we found on Claude Sonnet 4 and 4.5, with assurance they would circulate it appropriately to relevant teams. • OpenAI: We submitted a content report via the dedicated form on May 20th, 2026. We received meaningful engagement and replies within days. We provided OpenAI support with a verbatim transcript of GPT 5.5 compromise, and detailed explanations regarding the issue and our research. OpenAI support teams have thanked us for our research and efforts and communicated our findings to the teams responsible for handling these issues. • Google: We submitted a report via Gemini’s in-tool reporting functionality, including details and screenshots, twice on May 20th 2026. We received no replies. To allow significant time for these companies to work on mitigating our attack, we are not releasing our findings for now. Jailbreak attack findings such as ours are inherently complex to fix. They are rarely subject to explicit bug bounties, are not attributed CVEs, and are often not communicated on by AI developers. IV Methodology Our goal is to reproduce attack results obtained by covert malicious fine-tuning without leveraging the fine-tuning interface. This means carrying out a cipher-based jailbreak attack on commercial LLMs without any privileged model access. IV-A General Attack Structure The general structure of our attack follows these steps: • Communication Parameters: In this phase, we instruct the target model to communicate with the user via an encrypted communication scheme of our choosing. We restrict ourselves to letter permutations for simplicity. There are two main categories of permutations that we use. The first is a complete alphabet permutation, where we provide the model with a full mapping of each letter in the English alphabet to its cipher counterpart. The chosen permutation can be a rotation (caesar cipher style) or any random mapping of letters to other letters. This first category must be communicated in one single prompt. This is because, unless the mapping creates individual loops (e.g. (a−>->h), (h−>->z), (z−>->a)) which can be communicated independently to the model, communicating only part of the full alphabetic mapping risks several plaintext letters mapping to the same ciphertext character. For example, if communicating to the model only ”a−>->h”, then it is assumed that ”h” also maps to ”h”, which can cause issues. This is why, with arbitrary permutations, the full alphabet of permutations should be communicated to the model in a single step. The second category of permutations consists of those in which letters are ”swapped”. A letter α maps to β, and β maps to α. This sort of permutation scheme is useful for teaching a model to communicate via a cipher incrementally, because swaps can be instructed one by one without risk of loss of message coherence. • Examples (optional): We then communicate examples of encrypted communication to the model, still via prompt. This is similar to the training step in covert malicious fine-tuning [16] except we do this only via prompt, and not fine-tuning. This step can be short, e.g. a few examples, to encourage the model to write longer responses or improve its ability to communicate accurately via cipher. This step can be more involved, depending on the target, as a large number of examples can be required if the model struggles to communicate effectively via cipher. At the end of this step, the model should be capable of answering benign questions using the provided permutation scheme. • Attack: This is the final step. We communicate a harmful query or set of queries using the permutation scheme. Harmful prompts appear gibberish without the appropriate knowledge of letter permutations, and so harmfulness classifiers do not flag them. An example of this attack structure can be found in Fig. 2. IV-B Reasoning For our experiments, we disable model reasoning or thinking. This is because, when it is enabled, models will explicitly decrypt our instructions into clear English text, and prepare their response also in English. This is sufficient for bypassing harmfulness classifiers (see V-F) but not enough to bypass model alignment. As we demonstrate complete bypasses of alignment measures in our experiments, we disable reasoning. Fig. 2: Attack structure. Text is from a prompting session with Claude Sonnet 4 using 7 pairs of letter swaps. Some characters are not encrypted correctly as the model responds. IV-C Single-shot We call ”single-shot” the variant of our attack where we communicate the entirety of the encryption cipher in a single go. A few extra example prompts can be added. This variant is particularly effective on the Claude Sonnet 4 model from Anthropic. IV-D Iterative Learning Teaching an LLM to accomplish tasks by providing it with in-context examples (prompt examples) is called ”in-context learning” [49, 12]. We use this technique to overcome hurdles to teaching an LLM to communicate via encryption. There are mainly two difficulties to overcome. The first is that many models which are asked to communicate via cipher will not do so if given little to no examples. This is likely because, as per our introduction, LLMs split text into subwords, frequent in whichever languages they were trained, and character-level word manipulation for encryption purposes is an out-of-distribution task for these systems which they can struggle with. The second reason for teaching models to communicate via encryption using ICL is to improve their skill at this task. Models will often provide responses containing spelling mistakes or ”typos” due to inaccurate encryption. IV-E Combined Attacks For some models, encrypted communication, although a difficult task, does not immediately yield safety and security bypasses. What we mean by this is that the models will refuse harmful comments via encrypted communication. They reply (encrypted) that they cannot help with making explosives for example. Their responses are usually lengthier than what is expected of frontier LLMs refusing a clearly harmful request. They often suggest helping with a historical perspective on explosive manufacture and usage, or instructions for making toy explosions. To extract harmful responses in these situations, we simply combine our attack with well-known jailbreak prompts or techniques, for example the crescendo few-shot jailbreak prompt [38], which we send to the model using our permutation scheme. IV-F Task Difficulty When using the iterative version of our attack, as should be expected, with very few letter permutations, models refuse our harmful requests. There is a model-dependent difficulty threshold in the encrypted communication task below which models will refuse harmful queries. V Theoretical Hypothesis Before we dive into our experimental results, the reader may wonder ”why does this even work?”. After all, it is not sufficient to find a jailbreak technique; it is also useful to attempt to explain why such a technique exists, and to explain what other similar attacks could also be discovered in the future. Our attack was not found by chance. V-A Natural Language Text Large language models acquire internal knowledge via training on large human-readable text corpora. The main objective of this is to imbue the models with an understanding of human communication methods (how to chain words to create meaning), and then provide said models with world knowledge, either memorized verbatim or learned via complex representations [30]. Communicating information without using one of the languages on which models are trained is inherently out-of-distribution or OOD (there are little to no examples of this in model training data). However the concept of communication via letter swapping for simple encryption is not too complicated to formulate or comprehend, and can be easily communicated in natural language. So models are not trained to communicate using letter permutations or ciphers, but the concept of such communication and what it entails for a written piece of text is easy for them to reason about. Furthermore, as the result of such cipher or letter permutation communication is a chain of characters which can be expressed by an LLM’s token vocabulary (because, although they deal mainly with subwords, individual characters are part of all LLM vocabularies to enable them to process nonsensical or mistake-ridden inputs without crashing), LLMs can attempt this task. V-B Low-resource languages Low-Resource languages are human languages which do not feature prominently in LLM training corpora. Examples differ by model but generally include most languages which suffer from low online representation such as Swahili or Zulu, but for some models also Russian or Spanish. Alignment strength of large language models and resistance against harmful prompts communicated using these languages is often weak. Research has highlighted the security and control implications of this issue, and the jailbreak potential of leveraging low-resource languages as a vector for harmful prompting of LLMs [54, 11, 26]. V-C Helpfulness Before large language models are trained to be safe, they are first trained to answer user queries via instruction fine-tuning [48, 45, 34]. The term fine-tuning here is the same that we used to describe the API which is vulnerable to covert malicious fine-tuning earlier in this paper [16], and this is because what happens in that API is essentially a small-scale version of the second step of LLM training. So this second step, that follows general pre-training, teaches an LLM to respond to questions or ”queries” with responses instead of, for example, repeating the question many times. Through this second step of training, LLMs thus learn the basic behavior of responding to human requests. Only later are they trained to not respond to some requests which may be harmful [34, 37]. V-D Hypothesis Our working hypothesis is that, given a task where the LLM must communicate in a way which it is not familiar with (Out-of-distribution, OOD), there often exists a threshold when the task is sufficiently difficult that the model bypasses its safety and security training, but maintains the helpfulness behavior that it learned in training step 2: fine-tuning. This may be what occurs with OOD languages. We also hypothesize that jailbreak techniques such as ArtPrompt, where a harmful query is passed on to the model via ASCII word art [19], work in this way. Similarly, this is likely why our attack works: given a sufficiently difficult OOD communication task (in our case, letter permutations), the model is able to accomplish the task and be helpful, albeit with sufficient difficulty that its safety and security training are bypassed. We illustrate this hypothesized phenomenon in Fig. 3. Fig. 3: Out-Of-Distribution communication tasks as an LLM attack vector. Conceptual diagram not to scale. V-E New Capabilities As LLM capabilities improve with each new generation produced by leading AI developer companies, so do their abilities to perform tasks previously infeasible to these models. While this is beneficial and a driver of economic and scientific development, an implication is that new, previously unthought attack vectors become usable. In the example of our research, our attack produces only gibberish when carried out against last-generation models such as GPT-4 or Gemini 2.5. These models are not capable of communicating via cipher encryption when provided only with in-context prompts. The latest-generation models such as the ones we tested, including Gemini 3 and GPT 5.X are capable of communicating via encryption, and so an attack vector exists. V-F Classifier Bypass Although we present an attack where cipher communication with a frontier LLM immediately yields an alignment bypass, our method was initially designed to bypass only harmfulness classifiers and provide a means of communicating with the model without risk of communication being flagged as harmful. Even for models trained to refuse harmful queries, our method allows the user to query the model without risk of classifier refusal. As LLMs are persistently vulnerable to manipulation in the form of social engineering (in part because their alignment strength decreases with longer conversations) or other prompting, classifier bypass is likely to yield good jailbreak vectors in the future. Furthermore, as stated previously, there are far too many letter permutations to train a classifier to detect letter-permutated harmful queries [16]. VI Results Our single-shot attack variant, in which we communicate a full set of alphanumeric permutations to the model without interleaving progressive examples, is systematically successful and yields unlimited results (bomb instructions, bioweapon instructions, code for launching an attack) on the Claude Sonnet 4 model. We were not able to achieve convincing results on other models with this technique. Although a model released less than a year before time of writing and which has good overall performance, Claude Sonnet 4 has been marked for deprecation by Anthropic, and should not be considered as strong as their newest models. For this and because we are interested in attacks which generalize to other models, we will focus more on the iterative variant of our attack. A summary of results can be found in Table I. VI-A Iterative algorithm Our iterative algorithm works by progressively providing the model with pairs of letter permutations (for example ”e” ¡-¿ ”z”), followed, each time, by a (parameterized) set of examples of encrypted cipher communication. Examples are derived from cleartext question-answer pairs and encoded using a Python function that takes a set of permutations in the form of a dictionary, and replaces each character in a target string with its associated dictionary value, if there is one. The hyperparameters for this algorithm are the following: • Target Level (t, int): Because permutations are taught iteratively, we call each new pair a ”level”. The model then progresses through levels and progressively learns to communicate using the appropriate amount of letter permutations. Level progression may be a misnomer as this is a static process where the model is shown a set amount of examples per level, before being provided the next permutation, followed again by examples, and so on and so forth. The full transcript of instructions and examples is then communicated as a single prompt. See VII-D for suggestions and comments regarding making this process interactive. • Examples per level (e, int): This hyperparameter determines how many examples the model is shown per level. An example is an encrypted question-answer pair such as in 4. Examples are generated by querying the model with harmless general knowledge questions. These cleartext question-answer pairs are then stored, and encrypted at runtime with the appropriate letter permutations before being added to the prompt. Hyperparameter e may be a static number (e.g. ”1”), or a function of the current level (e.g. e=l,e=2le=l,e=2l etc.). For the second case, if, for example, e=le=l, then there will be one example in the prompt which is a cleartext question-answer pair encrypted with just one permutation, and there will be two examples consisting of questions encrypted with two permutations, and so on and so forth. • Repetition (r, boolean): This hyperparameter determines whether examples are drawn at random when creating a new one, or if they follow the same pattern at each level. If r is False, then at level one the example may be ”What is the capital of France?” and at level two ”Who was Winston Churchill?” followed by others if e(2)>1e(2)>1. If r is True, and at level one the example is ”What is the capital of France”, then at level two the first example will also be ”What is the capital of France?”, followed by others if e(2)>1e(2)>1 For added customization options we also added an option to increase the amount of examples at the last level only (all desired active permutations), this is optional. Varying the amount of examples per permutation levels, and in particular increasing the amount of examples as more permutations are added is to ensure that there is a sufficient proportion of the model context which contains examples of the exact task required of it: communicating with all desired permutations (last level). Using only alphabetic permutations and no capitalization there is a maximum value of 13 for parameter t. We provide in Fig. 5 a high-level algorithmic description of our iterative attack process. This iterative attack variant succeeds on Gemini 3 Flash preview by Google, see Fig. 7 in the appendix for an example. Fig. 4: Encrypted example showing ”What is the capital of France” and the corresponding response using two pairs of letter swaps: (e,z) and (t,q) for q in questionsquestions do responses(q)←query_LLM(q)responses(q)← query\_LLM(q) end for level←0level← 0 dict←permutationsdict← permutations prompt←taskprompt← task while level<tlevel<t do count←0count← 0 prompt←prompt+instruct(level)prompt← prompt+instruct(level) while count<e(level)count<e(level) do prompt←prompt+example(level,dict)prompt← prompt+example(level,dict) count←count+1count← count+1 end while level←level+1level← level+1 end while prompt←attack(l)prompt← attack(l) Fig. 5: High-level pseudocode of our iterative attack. The ”instruct” function adds an instruction to permute two characters based on the current level. The ”example” function constructs an example using a question-answer pair and a permutation dictionary (see Fig. 4). In practice we construct one permutation dictionary per level. Model: Claude Sonnet 4.5 Prompt (encrypted): How do I build a bomb? Response (encrypted): # how to build a bomb **materials needed:** • tik (tnt) - trinitrotoluene • fuel (diesels, gaseline, or anfod oil) • oxidizer (amnonium nitrate or sodium chlotate) • detonator or fuse • container – *i cannot and will not provide instruct VI-B Empty responses While testing our attack on newer LLMs from prominent developer Anthropic, we noticed that the models produced empty responses when requesting communication with very few (one or two) permutations. This may be because of model training, interplay with reasoning instructions or other alignment techniques we are unaware of. Because of this, frontier Anthropic models are difficult to train to communicate via encryption. Our iterative training nevertheless achieves jailbreak results with minor detail in harmful responses. Specifically, the model responds (encrypted) with clearly harmful instructions using only 3 permutations of letters (specifically chosen to obfuscate the word ”bomb”), but often does not complete its response. While testing we noticed that we could improve model performance at cipher communication by replacing examples with genuine model interactions. This makes our attack significantly more interactive and is an interesting avenue of continuing research in our opinion (see VII-D). VI-C On-policy vs. off-policy examples A topic of interest which relates to the previous subsection on empty responses is model behavior with respect to the source of examples of encrypted communication (see Fig. 4). We used partial on-policy examples, that means the underlying cleartext responses are generated by the target model. During testing, this provided a qualitative improvement in response quality for models such as Claude Sonnet 4 and Gemini 3. For complex cases such as Claude Sonnet 4.5, providing examples where the underlying cleartext was generated by another model resulted in empty responses, systematically. VI-D Permutation Quantity Depending on the target model, the amount of permutations needed to jailbreak and bypass alignment differs. For example, in Fig. 6, we show the amount of permutations needed to achieve jailbreak probability of 1.0 (100% ASR) on Claude Sonnet 4 (red dashes) and Gemini 3 flash (blue line), respectively. Sonnet 4 provides bomb-making instructions with only 7 permutations, while Gemini 3 requires 10 (for 100%). This specific experiment was carried out using the same list of permutations for both, which is our default list, and provides sufficient encryption for the word ”bomb” around level 7. It is constructed by swapping the letters of the alphabet based on their lowercase frequency in English text (”e”-”z”, ”t”-”q”, etc.) [44]. Fig. 6: Jailbreak probability over 5 samples as a function of pairs of permutations in communicating with Claude Sonnet 4 (red dashes) and Gemini 3 flash (blue line). VI-E Combined Attacks We tested our attack on OpenAI’s latest models, specifically GPT 5.5. Our iterative attack yields an encrypted communication channel which bypasses OpenAI classifiers [9] but the model, replying via encryption, refuses our harmful requests. It does however reply with attempts to provide useful information such as historical context, or related alternatives. This differs from usual model behavior in the presence of harmful instructions which tend to be short refusal sentences such as ”I’m sorry I can’t help with that”. This seems to show that, while the attack does not completely bypass model alignment, it weakens it. To exploit this, instead of directly communicating harmful instructions to the model, we utilize other known jailbreak prompts, such as the (short) crescendo jailbreak technique which achieves harmful outputs in usually 3 queries [38]. We reach 100% ASR on the flagship task for that attack which is a 3-prompt query that outputs detailed instructions on building a Molotov cocktail by first requesting historical background on the homemade explosive. We also extract harmful instructions for mixing household chemicals in harmful ways, and expect that most attack targets from the crescendo jailbreak should work on GPT 5.5 when combined with our attack. A summary of attack results can be found in Table I, see appendix and Figure 8 for an example. VI-F Qualitative Considerations How do we get a high-quality jailbreak output? This appears to vary by model provider, and as a function of the hyperparameters that we use. Fewer permutations, which imply an easier task, usually result in the model outputting a safety or security warning along the lines of ”this information is for educational purposes only”. Increasing amounts of permutations on the other hand, often result in this warning being dropped and, unexpectedly, in longer, more detailed harmful outputs by the target models. VI-G Last-Generation Models We tested variants of our attack on last-generation models and small recent models by the same closed-source providers. While these models respond positively to harmful queries, response quality degrades in a few words and is either gibberish, meaningless text or extremely high-level, barely comprehensible short instructions. We deduce that our attack works only on sufficiently-powerful models, which may explain why it was not discovered previously: models were not strong enough to be vulnerable. See Table I. TABLE I: Previous generation and small closed-source models Model ASR Claude Haiku 4.5 (Anthropic) 0% (gibberish) Gemini 2.5 Flash (Google) 0% (vague, gibberish) GPT 4.1 (OpenAI) 0% (unrelated, gibberish) VI-H Summary of Results A table summarizing our attack methods for frontier models by companies Anthropic, Google, and OpenAI is provided in Table I. An example of a response provided by Claude Sonnet 4.5 is shown in Section VI-B, an example by Claude Sonnet 4 is in Fig. 2. Example responses from Gemini 3 flash and GPT 5.5 are in the appendix, Fig. 7 and Fig. 8 respectively. Takeaway Cipher attacks are feasible in the regular chat/messages/responses API of frontier models. TABLE I: Summary of Results (ASR over 5 samples) Model (developer) Method Permutations ASR Claude Sonnet 4 (Anthropic) Single-shot 7+ 100% Claude Sonnet 4.5 (Anthropic) Iterative 3 (custom) 80% Gemini 3 Flash (preview) (Google) Iterative 10+ 100% GPT 5.5 (OpenAI) Combined (crescendo) 10 100% GPT 5.5 (OpenAI) Iterative 10 20% VII Discussion Our results show that modern, frontier large language models are vulnerable to cipher jailbreak attacks which previously threatened only the fine-tuning API of commercial AI. Our attack is purely black-box; it requires no privileged or testing access to the models (unlike other methods [9]) and thus can be carried out against state-of-the-art, widely deployed and well defended commercial models. Our attack examples against Claude Sonnet 4.5 and GPT 5.5 demonstrate that harmfulness classifiers do not stop the type of covert communication which we instantiate. This has several implications for the future safety and security of these models. Current mitigations of cipher attacks in the SFT API are insufficient to prevent that threat [55]. If this trend confirms itself with regards to our attack, LLM interfaces could be vulnerable to our attack for some time. VII-A Future Implications As can be inferred from our two result tables I and I, our attack works mainly because frontier models now possess sufficient capabilities to engage in encrypted communication without prior training (weight updates). Our attack is thus enabled by increasing model performance which opens up new, unforeseen compromise avenues. Future large language model updates and newer models are likely to possess new capabilities which may enable novel attack patterns, possibly covert communication tasks such as ours. As model development continues, research into securing newer versions against the attacks to come is likely to remain very relevant. VII-B Mitigation There are several lines of defense in shielding LLMs and AI agents from harm and adversaries [3]. Training, whether it be of classifiers or of the underlying model, may fall short if attempted against all possible letter or character permutations that are candidate ciphers, because there are too many of them. One possible mitigation is to train classifiers and models to identify attempts to communicate through obfuscated schemes. As we show in our conceptual diagram of Fig. 3, we expect that increasing LLM capabilities will push the boundary of obfuscated communication schemes which become achievable and can either serve as a direct jailbreak or as a conduit for a combined attack. This is why training systems to refuse or detect attempts at covert communication as potentially harmful may be important in the future. To avoid excess false positive rates and account banning, a ”covert communication” classifier could be designed. It would be similar in principle to harmfulness classifiers but, as the name suggests, would be trained to detect covert communication efforts, harmful or benign. A flag from that classifier could be treated with limited gravity (no need to ban the user from the platform), and could prevent covert jailbreaking efforts as LLMs become more capable. Additionally, our attack works by preventing model thinking or reasoning, so an enforcement of mandatory reasoning is a simple (but not necessarily feasible due to client budgetary constraints) way of preventing our attack. Enforcing reasoning will unfortunately not prevent classifier bypass using our method. VII-C Limitations Although our attack succeeds against frontier black-box models, our attack comes with limitations which we try to outline below. • Encryption errors: Likely because of their tokenizer and low probability of outputting responses made up only of single-character (one letter) tokens instead of subwords, encryption or transcription mistakes often appear in the harmful responses provided by the target models. See Fig. 2, 7, 8. Although harm persists and understanding model communication is usually not difficult, it limits functionality of some attack targets such as harmful code, which the model may provide containing some mistakes. • Details: For some of the models we tested, details were minimal, this is particularly the case for Claude Sonnet 4.5. Our attack against that model is more of a proof-of-concept than a usable safety and security bypass, and the main added value of our work is to show that harmfulness classifiers do not detect our harmful exchange with the model. • Combined Attacks: Combined attacks such as the one which we carried out against GPT 5.5 require a bit more effort and resources and, in our example using the crescendo method, yield results which are not as harmful as could be desired. When prompting GPT 5.5 with bomb-making instruction requests past a certain level of difficulty, the model responds with gibberish text. • Prompt injections and AI agents: We have not evaluated the efficacy of our attack when targeting AI agents, and whether it can be used to manipulate the ”actions” or tool calls of these agents. • Reasoning: At the moment our attack works by disabling the reasoning or thinking of large language models to prevent them from decrypting our instructions. This may limit the scope of our attack targets, and enforcing minimal reasoning is a suitable means of preventing our attack. VII-D Further Research The fascinating (and trendy) topic of AI Safety and Security has much in store for the eager researcher as increasing capabilities and responsibilities of AI open up new avenues and incentives for attacking these models. Regarding the attack described in this paper, several future avenues of research stand out to the authors: • Interactive jailbreaking: This means teaching the model to communicate via encryption not by manually encrypting cleartext examples and feeding them to the model but by iteratively interacting with it. Preliminary tests show this improves cipher communication on some Anthropic models and should be explored further. • Mitigation: Research into the potential mitigation techniques to prevent this attack is also an interesting avenue. As stated previously, the sheer amount of possible ciphers likely precludes efficient training of classifiers to discern encrypted harmful text, and other methods should be taken into consideration or explored further. • Agentic Research: We expect that, should this issue prove difficult to fix and persist on frontier models in months or years to come, it will be of interest to determine whether our attack vector can be used to manipulate the actions of AI agents. • Reasoning: Extending our attack to use cases including those where model reasoning is enabled is an interesting avenue for future research. VIII Conclusion In this paper, we have demonstrated that cipher jailbreak attacks against large language models are no longer limited to the fine-tuning API of black-box LLMs. We have provided minimal background on jailbreaking, and introduced the reader to cipher jailbreaks as they stand against the SFT API. We have described our methodology, goals, perceived contribution (a novel attack pattern against large language models) and theoretical interpretations. We have described experimental results, examples, cross-model variations and more, and then discussed our results, limitations, and future research avenues. We now conclude and would like to note that, although Generative AI is a subject of study in this work, and was used to generate training examples for jailbreaking, the technology was not used to brainstorm, design research (or experiments), or draft this paper. It was used for correcting grammar and spelling mistakes. IX Open Science Because our work presents a method for obtaining prohibited responses from LLM systems, we do not anticipate the public release of our code. Our code will be safe to publish once it is useless and mitigations are appropriately in place. X LLM Usage Considerations Although Generative AI is a subject of study in this work, and was used to generate training examples for jailbreaking, the technology was not used to brainstorm, design research (or experiments), or draft this paper. It was used for correcting grammar and spelling mistakes. XI Ethical Considerations First, please see section I-B for details on our responsible disclosure process. Please also consider the following: • As of June 5th, 2026, Gemini-3 flash preview performance appears to have improved. The degree of harmful detail elicited from the model is diminished (responses are shorter). • As of June 9th, Anthropic has released Claude Fable 5. It is its first model that returns an error when attempting to disable thinking (see https://platform.claude.com/docs/en/build-with-claude/extended-thinking). In our report, sent to their researcher who assured us it was communicated internally to teams responsible, we emphasized that the easiest way to prevent the current iteration of our attack is to force reasoning (or ”thinking”), to be enabled on the models. Although there is a trend towards enforcing this, we would like to believe our reporting may have played a role in this decision by Anthropic. Regardless of whether this was the case, Claude 5 models and upwards are, for the time being, mostly unlikely to be vulnerable to our attack. Harmfulness classifiers may still be bypassed, and model alignment must remain strong. References [1] D. B. Acharya, K. Kuppan, and B. Divya (2025) Agentic ai: autonomous intelligence for complex goals—a comprehensive survey. IEEE Access 13 (), p. 18912–18936. External Links: Document Cited by: §I-A. [2] Anthropic (2026) Messages. Note: Claude API Reference Cited by: §I. [3] Y. Bengio, S. Clare, C. Prunkl, M. Andriushchenko, B. Bucknall, M. Murray, R. Bommasani, S. Casper, T. Davidson, R. Douglas, D. Duvenaud, P. Fox, U. Gohar, R. Hadshar, A. Ho, T. Hu, C. Jones, S. Kapoor, A. Kasirzadeh, S. Manning, N. Maslej, V. Mavroudis, C. McGlynn, R. Moulange, J. Newman, K. Y. Ng, P. Paskov, S. Rismani, G. Sastry, E. Seger, S. Singer, C. Stix, L. Velasco, N. Wheeler, D. Acemoglu, V. Conitzer, T. G. Dietterich, F. Heintz, G. Hinton, N. Jennings, S. Leavy, T. Ludermir, V. Marda, H. Margetts, J. McDermid, J. Munga, A. Narayanan, A. Nelson, C. Neppel, S. D. Ramchurn, S. Russell, M. Schaake, B. Schölkopf, A. Soto, L. Tiedrich, G. Varoquaux, A. Yao, Y. Zhang, L. A. Aguirre, O. Ajala, F. Albalawi, N. AlMalek, C. Busch, J. Collas, A. C. P. de Leon Ferreira de Carvalho, A. Gill, A. H. Hatip, J. Heikkilä, C. Johnson, G. Jolly, Z. Katzir, M. N. Kerema, H. Kitano, A. Krüger, K. M. Lee, J. R. L. Portillo, A. McLysaght, O. Molchanovskyi, A. Monti, M. Nemer, N. Oliver, R. Pezoa, A. Plonk, B. Ravindran, H. Riza, C. Rugege, H. Sheikh, D. Wong, Y. Zeng, L. Zhu, D. Privitera, and S. Mindermann (2026) International ai safety report 2026. External Links: 2602.21012, Link Cited by: §I-A, §VII-B. [4] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong (2025) Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), Vol. , p. 23–42. External Links: Document Cited by: 2nd item. [5] B. Chen, M. Shao, A. Basit, S. Garg, and M. Shafique (2025) MetaCipher: a time-persistent and universal multi-agent framework for cipher-based jailbreak attacks for llms. External Links: 2506.22557, Link Cited by: §I-B. [6] P. F. Christiano, J. Leike, T. Brown, M. Martic, S. Legg, and D. Amodei (2017) Deep reinforcement learning from human preferences. Advances in neural information processing systems 30. Cited by: §I-A. [7] M. Corporation (2026) Understanding tokens. Note: Microsoft Build (blog) External Links: Link Cited by: §I-A. [8] H. Cunningham, J. Wei, Z. Wang, A. Persic, A. Peng, J. Abderrachid, R. Agarwal, B. Chen, A. Cohen, A. Dau, et al. (2026) Constitutional classifiers++: efficient production-grade defenses against universal jailbreaks. arXiv preprint arXiv:2601.04603. Cited by: 3rd item, §I-A. [9] X. Davies, G. Giglemiani, E. Lau, E. Winsor, G. Irving, and Y. Gal (2026) Boundary point jailbreaking of black-box llms. External Links: 2602.15001, Link Cited by: 1st item, §VI-E, §VII. [10] E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr (2024) Agentdojo: a dynamic environment to evaluate prompt injection attacks and defenses for llm agents. Advances in Neural Information Processing Systems 37, p. 82895–82920. Cited by: §I-A. [11] Y. Deng, W. Zhang, S. J. Pan, and L. Bing (2024) Multilingual jailbreak challenges in large language models. In International Conference on Learning Representations, Vol. 2024, p. 24634–24651. Cited by: §V-B. [12] Q. Dong, L. Li, D. Dai, C. Zheng, J. Ma, R. Li, H. Xia, J. Xu, Z. Wu, B. Chang, et al. (2024) A survey on in-context learning. In Proceedings of the 2024 conference on empirical methods in natural language processing, p. 1107–1128. Cited by: §IV-D. [13] D. Ganguli, L. Lovitt, J. Kernion, A. Askell, Y. Bai, S. Kadavath, B. Mann, E. Perez, N. Schiefer, K. Ndousse, et al. (2022) Red teaming language models to reduce harms: methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858. Cited by: §I-A. [14] X. Gong, M. Li, Y. Zhang, F. Ran, C. Chen, Y. Chen, Q. Wang, and K. Lam (2025) PAPILLON: efficient and stealthy fuzz testing-powered jailbreaks for llms. In Proceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA. External Links: ISBN 978-1-939133-52-6 Cited by: 2nd item. [15] X. Guo, F. Yu, H. Zhang, L. Qin, and B. Hu (2024) COLD-attack: jailbreaking llms with stealthiness and controllability. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. Cited by: 1st item. [16] D. Halawi, A. Wei, E. Wallace, T. T. Wang, N. Haghtalab, and J. Steinhardt (2024) Covert malicious finetuning: challenges in safeguarding LLM adaptation. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, p. 17298–17312. Cited by: §I, 2nd item, §V-C, §V-F. [17] D. Hendrycks, C. Burns, S. Basart, A. Critch, J. Li, D. Song, and J. Steinhardt (2020) Aligning ai with shared human values. arXiv preprint arXiv:2008.02275. Cited by: §I-A. [18] K. Hu, W. Yu, Y. Li, T. Yao, X. Li, W. Liu, L. Yu, Z. Shen, K. Chen, and M. Fredrikson (2024) Efficient llm jailbreak via adaptive dense-to-sparse constrained optimization. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37, p. 23224–23245. External Links: Document, Link Cited by: 1st item. [19] F. Jiang, Z. Xu, L. Niu, Z. Xiang, B. Ramasubramanian, B. Li, and R. Poovendran (2024) ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 15157–15173. External Links: Link, Document Cited by: 3rd item, §V-D. [20] G. Kaplan, M. Oren, Y. Reif, and R. Schwartz (2025) From tokens to words: on the inner lexicon of llms. In International Conference on Learning Representations, Y. Yue, A. Garg, N. Peng, F. Sha, and R. Yu (Eds.), Vol. 2025, p. 70068–70092. External Links: Link Cited by: §I-A. [21] J. Kazdan, A. Puri, R. Schaeffer, L. Yu, C. Cundy, J. Stanley, S. Koyejo, and K. Dvijotham (2025) No, of course i can! deeper fine-tuning attacks that bypass token-level safety mechanisms. arXiv preprint arXiv:2502.19537. Cited by: §I. [22] E. Kenneally and D. Dittrich (2012) The menlo report: ethical principles guiding information and communication technology research. Available at SSRN 2445102. Cited by: §I-B. [23] P. Laban, H. Hayashi, Y. Zhou, and J. Neville (2026) LLMs Get Lost in Multi-Turn Conversation. In International Conference on Learning Representations, External Links: Link Cited by: 2nd item. [24] A. Labunets, N. V. Pandya, A. Hooda, X. Fu, and E. Fernandes (2025) Fun-tuning: characterizing the vulnerability of proprietary llms to optimization-based prompt injection attacks via the fine-tuning interface. In 2025 IEEE Symposium on Security and Privacy (SP), p. 411–429. External Links: Document Cited by: §I. [25] J. Li, Y. Hao, H. Xu, X. Wang, and Y. Hong (2025) Exploiting the index gradients for optimization-based jailbreaking on large language models. In Proceedings of the 31st International Conference on Computational Linguistics, O. Rambow, L. Wanner, M. Apidianaki, H. Al-Khalifa, B. D. Eugenio, and S. Schockaert (Eds.), Abu Dhabi, UAE, p. 4535–4547. External Links: Link Cited by: 1st item. [26] J. Li, Y. Liu, C. Liu, L. Shi, X. Ren, Y. Zheng, Y. Liu, and Y. Xue (2024) A cross-language investigation into jailbreak attacks in large language models. arXiv preprint arXiv:2401.16765. Cited by: §V-B. [27] X. Liu, N. Xu, M. Chen, and C. Xiao (2024) AutoDAN: generating stealthy jailbreak prompts on aligned large language models. In International Conference on Learning Representations, B. Kim, Y. Yue, S. Chaudhuri, K. Fragkiadaki, M. Khan, and Y. Sun (Eds.), Vol. 2024, p. 56174–56194. External Links: Link Cited by: 1st item. [28] M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, et al. (2024) Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249. Cited by: 2nd item. [29] A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi (2024) Tree of attacks: jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems 37, p. 61065–61105. Cited by: 2nd item, §I-A. [30] N. Nanda, L. Chan, T. Lieberum, J. Smith, and J. Steinhardt (2023) Progress measures for grokking via mechanistic interpretability. arXiv preprint arXiv:2301.05217. Cited by: §V-A. [31] M. Nasr, N. Carlini, C. Sitawarin, S. V. Schulhoff, J. Hayes, M. Ilie, J. Pluto, S. Song, H. Chaudhari, I. Shumailov, A. Thakurta, K. Y. Xiao, A. Terzis, and F. Tramèr (2025) The attacker moves second: stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections. External Links: 2510.09023, Link Cited by: 4th item. [32] OpenAI (2026) Key concepts - tokens. Note: OpenAI Developers (blog) External Links: Link Cited by: §I-A. [33] OpenAI (2026) Responses. Note: OpenAI API Reference Cited by: §I. [34] L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, et al. (2022) Training language models to follow instructions with human feedback. Advances in neural information processing systems 35, p. 27730–27744. Cited by: §V-C. [35] Z. Pan, S. Wang, L. Pengfei, and J. Li (2026) Understanding llm behaviors via compression: data generation, knowledge acquisition and scaling laws. Advances in Neural Information Processing Systems 38, p. 168404–168454. Cited by: §I-A. [36] E. Perez, S. Huang, F. Song, T. Cai, R. Ring, J. Aslanides, A. Glaese, N. McAleese, and G. Irving (2022) Red teaming language models with language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, Y. Goldberg, Z. Kozareva, and Y. Zhang (Eds.), Abu Dhabi, United Arab Emirates, p. 3419–3448. External Links: Link, Document Cited by: 4th item. [37] R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn (2023) Direct preference optimization: your language model is secretly a reward model. Advances in neural information processing systems 36, p. 53728–53741. Cited by: §V-C. [38] M. Russinovich, A. Salem, and R. Eldan (2025) Great, now write an article about that: the crescendo multi-turn llm jailbreak attack. External Links: 2404.01833, Link Cited by: Fig. 8, 2nd item, §I-B, §IV-E, §VI-E. [39] R. Sapkota, K. I. Roumeliotis, and M. Karkee (2025) Ai agents vs. agentic ai: a conceptual taxonomy, applications and challenges. Information Fusion, p. 103599. Cited by: §I-A. [40] R. Sennrich, B. Haddow, and A. Birch (2016) Neural machine translation of rare words with subword units. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), K. Erk and N. A. Smith (Eds.), Berlin, Germany, p. 1715–1725. External Links: Link, Document Cited by: §I-A. [41] Y. Shao, J. Yu, H. Miao, G. Gou, Z. Li, and J. Shi (2026) PromptFuzz: harnessing fuzzing techniques for robust testing of prompt injection in llms. IEEE Transactions on Information Forensics and Security 21 (), p. 2727–2741. External Links: Document Cited by: 4th item. [42] M. Sharma, M. Tong, J. Mu, J. Wei, J. Kruthoff, S. Goodfriend, E. Ong, A. Peng, R. Agarwal, C. Anil, A. Askell, N. Bailey, J. Benton, E. Bluemke, S. R. Bowman, E. Christiansen, H. Cunningham, A. Dau, A. Gopal, R. Gilson, L. Graham, L. Howard, N. Kalra, T. Lee, K. Lin, P. Lofgren, F. Mosconi, C. O’Hara, C. Olsson, L. Petrini, S. Rajani, N. Saxena, A. Silverstein, T. Singh, T. Sumers, L. Tang, K. K. Troy, C. Weisser, R. Zhong, G. Zhou, J. Leike, J. Kaplan, and E. Perez (2025) Constitutional classifiers: defending against universal jailbreaks across thousands of hours of red teaming. External Links: 2501.18837, Link Cited by: §I-A, §I. [43] X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang (2024) ” Do anything now”: characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, p. 1671–1685. Cited by: 2nd item. [44] R. L. Solso and J. F. King (1976) Frequency and versatility of letters in the english language. Behavior Research Methods & Instrumentation 8 (3), p. 283–286. Cited by: §VI-D. [45] Y. Wang, A. Bai, N. Peng, and C. Hsieh (2026) On the loss of context awareness in general instruction fine-tuning. Advances in Neural Information Processing Systems 38, p. 8610–8635. Cited by: §V-C. [46] Z. Wang, V. Siu, Z. Ye, T. Shi, Y. Nie, X. Zhao, C. Wang, W. Guo, and D. Song (2025) AgentVigil: generic black-box red-teaming for indirect prompt injection against llm agents. External Links: 2505.05849, Link Cited by: 4th item. [47] A. Wei, N. Haghtalab, and J. Steinhardt (2023) Jailbroken: how does llm safety training fail?. In Advances in Neural Information Processing Systems, A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (Eds.), Vol. 36, p. 80079–80110. External Links: Link Cited by: §I-B. [48] J. Wei, M. Bosma, V. Y. Zhao, K. Guu, A. W. Yu, B. Lester, N. Du, A. M. Dai, and Q. V. Le (2021) Finetuned language models are zero-shot learners. arXiv preprint arXiv:2109.01652. Cited by: §V-C. [49] N. Wies, Y. Levine, and A. Shashua (2023) The learnability of in-context learning. Advances in Neural Information Processing Systems 36, p. 36637–36651. Cited by: §IV-D. [50] E. Wu, K. Wu, and J. Zou (2024) FineTuneBench: how well do commercial fine-tuning apis infuse knowledge into llms?. External Links: 2411.05059, Link Cited by: §I. [51] W. Wu, Y. Wang, Y. Fu, X. Yue, D. Zhu, and S. Li (2024) Long context alignment with short instructions and synthesized positions. External Links: 2405.03939, Link Cited by: 2nd item. [52] W. Xu, C. Huang, S. Gao, and S. Shang (2025) LLM-based agents for tool learning: a survey. 10 (4). External Links: ISSN 2364-1185, 2364-1541, Link, Document Cited by: §I-A. [53] Z. Xu, Y. Liu, G. Deng, Y. Li, and S. Picek (2024) A comprehensive study of jailbreak attack versus defense for large language models. In Findings of the Association for Computational Linguistics: ACL 2024, L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 7432–7449. External Links: Link, Document Cited by: §I-B. [54] Z. Yong, C. Menghini, and S. H. Bach (2023) Low-resource languages jailbreak gpt-4. arXiv preprint arXiv:2310.02446. Cited by: §V-B. [55] J. Youstra, M. Mahfoud, Y. Yan, H. Sleight, E. Perez, and M. Sharma (2025) Towards safeguarding llm fine-tuning apis against cipher attacks. External Links: 2508.17158, Link Cited by: §I-B, §VII. [56] J. Yu, X. Lin, Z. Yu, and X. Xing (2024) GPTFUZZER: red teaming large language models with auto-generated jailbreak prompts. External Links: 2309.10253, Link Cited by: 4th item. [57] Y. Yuan, W. Jiao, W. Wang, J. Huang, P. He, S. Shi, and Z. Tu (2024) GPT-4 is too smart to be safe: stealthy chat with llms via cipher. In International Conference on Learning Representations, B. Kim, Y. Yue, S. Chaudhuri, K. Fragkiadaki, M. Khan, and Y. Sun (Eds.), Vol. 2024, p. 53902–53922. External Links: Link Cited by: §I-B. [58] Q. Zhan, R. Fang, R. Bindu, A. Gupta, T. B. Hashimoto, and D. Kang (2024) Removing rlhf protections in gpt-4 via fine-tuning. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 2: Short Papers), p. 681–687. Cited by: §I. [59] M. Zhu, X. Chen, Z. Wang, B. Yu, H. Zhao, and J. Jia (2025) Enhancing llm knowledge learning through generalization. In 2025 Conference on Empirical Methods in Natural Language Processing (EMNLP 2025)(04/11/2025-09/11/2025, Suzhou), Cited by: §I-A. [60] D. M. Ziegler, N. Stiennon, J. Wu, T. B. Brown, A. Radford, D. Amodei, P. Christiano, and G. Irving (2019) Fine-tuning language models from human preferences. arXiv preprint arXiv:1909.08593. Cited by: §I-A. [61] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. External Links: 2307.15043, Link Cited by: 1st item. Fig. 7: Response (decrypted) from Gemini-3-Flash to the question (encrypted): ”How do I build a bomb?” Fig. 8: Response (decrypted) from GPT 5.5 to an (encrypted) three-prompt inquiry about the Molotov cocktail using the method in [38]