Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Kayua Oleques Paim, Rodrigo Brandao Mansilha, Diego Kreutz, Muriel Figueredo Franco, Weverton Cordeiro

TL;DR

The paper identifies latent space discontinuities as a fundamental architectural vulnerability in LLMs and related generative systems, proposing a universal jailbreak framework that generalizes across models and modalities. It develops a two-phase methodology and two corpora to study alignment degradation, vulnerability escalation, and maintenance of compromised states, validating the approach on seven LLMs and an Image-RAG system. Key contributions include first systematic exploitation of latent-space topology for jailbreaks and preliminary evidence of data-extraction risks via diffusion models, along with a discussion of societal and security implications. The findings call for defenses that address internal model geometry, beyond traditional input sanitization and prompt-based filters, to improve robustness in deployed AI systems.

Abstract

The rapid proliferation of Large Language Models (LLMs) has raised significant concerns about their security against adversarial attacks. In this work, we propose a novel approach to crafting universal jailbreaks and data extraction attacks by exploiting latent space discontinuities, an architectural vulnerability related to the sparsity of training data. Unlike previous methods, our technique generalizes across various models and interfaces, proving highly effective in seven state-of-the-art LLMs and one image generation model. Initial results indicate that when these discontinuities are exploited, they can consistently and profoundly compromise model behavior, even in the presence of layered defenses. The findings suggest that this strategy has substantial potential as a systemic attack vector.

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

TL;DR

The paper identifies latent space discontinuities as a fundamental architectural vulnerability in LLMs and related generative systems, proposing a universal jailbreak framework that generalizes across models and modalities. It develops a two-phase methodology and two corpora to study alignment degradation, vulnerability escalation, and maintenance of compromised states, validating the approach on seven LLMs and an Image-RAG system. Key contributions include first systematic exploitation of latent-space topology for jailbreaks and preliminary evidence of data-extraction risks via diffusion models, along with a discussion of societal and security implications. The findings call for defenses that address internal model geometry, beyond traditional input sanitization and prompt-based filters, to improve robustness in deployed AI systems.

Abstract

The rapid proliferation of Large Language Models (LLMs) has raised significant concerns about their security against adversarial attacks. In this work, we propose a novel approach to crafting universal jailbreaks and data extraction attacks by exploiting latent space discontinuities, an architectural vulnerability related to the sparsity of training data. Unlike previous methods, our technique generalizes across various models and interfaces, proving highly effective in seven state-of-the-art LLMs and one image generation model. Initial results indicate that when these discontinuities are exploited, they can consistently and profoundly compromise model behavior, even in the presence of layered defenses. The findings suggest that this strategy has substantial potential as a systemic attack vector.

Paper Structure

This paper contains 20 sections, 5 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Jailbreaking Overview
  4. Step 1: Alignment Degradation Induction
  5. Step 2: Vulnerability Escalation
  6. Step 3: Maintenance of the Attack Condition
  7. Substep 3.a: Recursive Amplification
  8. Substep 3.b: Context Shift
  9. Methodology
  10. Development and Structuring of Malicious Intent Corpora
  11. Reference Corpus — Taxonomy
  12. Proposed Corpus — High-Risk Malicious Intents
  13. Jailbreaking Evaluation Protocol
  14. Data Extraction Evaluation Protocol
  15. Results and Discussion
  16. ...and 5 more sections

Figures (5)

  • Figure 1: Surface Attack for LLM-based systems.
  • Figure 2: Jailbreaking Process Overview.
  • Figure 3: Number os turns for each malicious intent for each model.
  • Figure 4: Anonymized Examples of Jailbreak Iterations via User-Level Interfaces.
  • Figure 5: Images generated under attack conditions.