Safety research on large language models (LLMs) is heavily focused on detecting and preventing jailbreak attacks—alignment bypasses that let an adversarial user elicit unwanted or harmful outputs.
Arbitrary cipher (covert communication) attacks are a class of jailbreak previously demonstrated on commercial models via fine‑tuning APIs. In those attacks the target model is fine‑tuned on an encrypted corpus of harmful questions and answers, learning a secret encryption scheme to answer malicious requests.
We show that the newest frontier models acquire the same cipher‑based communication skills without any fine‑tuning. By crafting suitable prompts or providing in‑context examples, the model can infer and use the encryption mapping on the fly.
When interaction occurs through the learned cipher, model alignment is dramatically weakened or entirely bypassed. Harmfulness classifiers are evaded because the encrypted payload appears as gibberish rather than toxic text.
We successfully jailbreak frontier models from Anthropic, Google, and OpenAI, establishing a novel attack vector against black‑box LLMs.
The attack leverages the model’s powerful language understanding and generation abilities, embedding the cipher mapping directly in the prompt, thus requiring no additional training.
Review