Jailbreaking via Word Substitution and Novel Ciphers
Date: 2024-02
Affected: GPT-4, Claude, Gemini, reasoning LLMs
Attack vector: jailbreak
Category: research
Severity: High

Handa et al. show self-defined word substitution ciphers and stacked encryptions (Base64+ROT13+substitution) bypass safety alignment without complex multi-turn exchanges. Higher ASR than CipherChat on reasoning-capable LLMs.


Mitigations:

Architectural layers (MAESTRO):