Beyond Jailbreaks: Revealing Stealthier and Broader LLM Security Risks Stemming from Alignment Failures

2025/06/09 by Zhou, Yukai, Wenjie Wang, Yang, Sibei +1
Computer Science · Social Sciences · #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #Ethics and Social Impacts of AI #FOS: Computer and information sciences #Topic Modeling

paper · pdf · doi:10.48550/arxiv.2506.07402

openalex publication_date 2025/06/09 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Large language models (LLMs) are increasingly deployed in real-world applications, raising concerns about their security. While jailbreak attacks highlight failures under overtly harmful queries, they overlook a critical risk: incorrectly answering harmless-looking inputs can be dangerous and cause real-world harm (Implicit Harm). We systematically reformulate the LLM risk landscape through a structured quadrant perspective based on output factuality and input harmlessness, uncovering an overlooked high-risk region. To investigate this gap, we propose JailFlipBench, a benchmark aims to capture implicit harm, spanning single-modal, multimodal, and factual extension scenarios with diverse evaluation metrics. We further develop initial JailFlip attack methodologies and conduct comprehensive evaluations across multiple open-source and black-box LLMs, show that implicit harm present immediate and urgent real-world risks, calling for broader LLM safety assessments and alignment beyond conventional jailbreak paradigms.

Citations

• Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models
• The Jailbreak Tax: How Useful are Your Jailbreak Outputs?
• Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
• LLM-Safety Evaluations Lack Robustness
• SG-Bench: Evaluating LLM Safety Generalization Across Diverse Tasks and Prompt Types
• Multimodal Situational Safety
• AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs
• AIR-Bench 2024: A Safety Benchmark Based on Risk Categories from Regulations and Policies
• Jailbreak Attacks and Defenses Against Large Language Models: A Survey
• The Art of Saying No: Contextual Noncompliance in Language Models
• SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal
• JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models
• Safety Alignment Should Be Made More Than Just a Few Tokens Deep
• MMLU-Pro: A More Robust and Challenging Multi-Task Language Understanding Benchmark
• Improved Techniques for Optimization-Based Jailbreaking on Large Language Models
• Don't Say No: Jailbreaking LLM by Suppressing Refusal
• AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs
• AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs
• Rethinking How to Evaluate Language Model Jailbreak
• Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models
• Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models
• A StrongREJECT for Empty Jailbreaks
• Comprehensive Assessment of Jailbreak Attacks Against LLMs
• Weak-to-Strong Jailbreaking on Large Language Models
• How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
• Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
• AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation
• Multilingual Jailbreak Challenges in Large Language Models
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models
• GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts
• Code of "Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs"
• Jailbroken: How Does LLM Safety Training Fail?
• Are aligned neural networks adversarially aligned?
• Direct Preference Optimization: Your Language Model is Secretly a Reward Model
• Scaling Instruction-Finetuned Language Models
• Training language models to follow instructions with human feedback
• TruthfulQA: Measuring How Models Mimic Human Falsehoods
• Fine-Tuning Language Models from Human Preferences
• A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models

Related

• Confusion is the Final Barrier: Rethinking Jailbreak Evaluation and Investigating the Real Misuse Threat of LLMs
• HarmLevelBench: Evaluating Harm-Level Compliance and the Impact of Quantization on Model Alignment
• Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions
• A Simple and Efficient Jailbreak Method Exploiting LLMs' Helpfulness
• LLMs can be Dangerous Reasoners: Analyzing-based Jailbreak Attack on Large Language Models