Jailbreak Mimicry: Automated Discovery of Narrative-Based Jailbreaks for Large Language Models
Pavlos Ntais
TL;DR
This work identifies contextual framing as a fundamental vulnerability in large language model safety and introduces Jailbreak Mimicry, a reproducible methodology that automates narrative-based jailbreak prompt discovery using LoRA-finetuned Mistral-7B. The approach trains a compact attacker to produce reframings that reliably bypass safety controls on large target models, achieving an overall ASR of $0.810$ on a held-out GPT-OSS-20B set and substantial cross-model transfer ($0.665$ on GPT-4, $0.795$ on Llama-3, $0.330$ on Gemini 2.5 Flash), representing up to a $54\times$ improvement over direct prompting. The study conducts a cross-model vulnerability analysis across cybersecurity, fraud, misinformation, and other domains, showing universal weaknesses in technical domains and model-specific defensive strengths, and employs a hybrid human-AI evaluation framework for scalable harm assessment. It concludes with a set of defensive recommendations—spanning multi-layer defenses, adversarial training, context-aware safety, and architectural innovations—and outlines limitations and future directions, including reinforcement learning, cross-model mapping, defensive co-evolution, and multi-modal extensions.
Abstract
Large language models (LLMs) remain vulnerable to sophisticated prompt engineering attacks that exploit contextual framing to bypass safety mechanisms, posing significant risks in cybersecurity applications. We introduce Jailbreak Mimicry, a systematic methodology for training compact attacker models to automatically generate narrative-based jailbreak prompts in a one-shot manner. Our approach transforms adversarial prompt discovery from manual craftsmanship into a reproducible scientific process, enabling proactive vulnerability assessment in AI-driven security systems. Developed for the OpenAI GPT-OSS-20B Red-Teaming Challenge, we use parameter-efficient fine-tuning (LoRA) on Mistral-7B with a curated dataset derived from AdvBench, achieving an 81.0% Attack Success Rate (ASR) against GPT-OSS-20B on a held-out test set of 200 items. Cross-model evaluation reveals significant variation in vulnerability patterns: our attacks achieve 66.5% ASR against GPT-4, 79.5% on Llama-3 and 33.0% against Gemini 2.5 Flash, demonstrating both broad applicability and model-specific defensive strengths in cybersecurity contexts. This represents a 54x improvement over direct prompting (1.5% ASR) and demonstrates systematic vulnerabilities in current safety alignment approaches. Our analysis reveals that technical domains (Cybersecurity: 93% ASR) and deception-based attacks (Fraud: 87.8% ASR) are particularly vulnerable, highlighting threats to AI-integrated threat detection, malware analysis, and secure systems, while physical harm categories show greater resistance (55.6% ASR). We employ automated harmfulness evaluation using Claude Sonnet 4, cross-validated with human expert assessment, ensuring reliable and scalable evaluation for cybersecurity red-teaming. Finally, we analyze failure mechanisms and discuss defensive strategies to mitigate these vulnerabilities in AI for cybersecurity.