FlipAttack: Jailbreaking LLMs via Flipping
Date: 2024-10
Affected: GPT-4o, GPT-4, Claude, Gemini, Llama-3
Attack vector: jailbreak
Category: research
Severity: High

Liu et al. demonstrate that simply flipping word or character order disguises harmful prompts. With four flipping modes, FlipAttack achieves ~98 percent attack success on GPT-4o and ~98 percent bypass against five guardrail models in a single query.


Mitigations:

Architectural layers (MAESTRO):