The Structural Safety Generalization Problem (2025)

Abstract: LLM jailbreaks are a widespread safety challenge. Given this problem has not yet been tractable, we suggest targeting a key failure mechanism: the failure of safety to generalize across semantically equivalent inputs. We further focus the target by requiring desirable tractability properties of attacks to study: explainability, transferability between models, and transferability between goals. We perform red-teaming within this framework by uncovering new vulnerabilities to multi-turn, multi-image, and translation-based attacks. These attacks are semantically equivalent by our design to their single-turn, single-image, or untranslated counterparts, enabling systematic comparisons; we show that the different structures yield different safety outcomes. We then demonstrate the potential for this framework to enable new defenses by proposing a Structure Rewriting Guardrail, which converts an input to a structure more conducive to safety assessment. This guardrail significantly improves refusal of harmful inputs, without over-refusing benign ones. Thus, by framing this intermediate challenge—more tractable than universal defenses but essential for long-term safety—we highlight a critical milestone for AI safety research.

## introduction the progress of recent ai systems can be a doubleedged sword: new model capabilities potentially open new vulnerabilities. single-turn attacks are the most extensively explored in the literature surrounding llms @xcite @xcite , yet expanding context windows and agentic capabilities make multi-turn interactions prevalent. singleimage attacks, as well as text-only and image-only attacks, are the most studied @xcite , but recent systems offer multi-modal, multi-image capabilities @xcite . safety research often focuses on highresource languages like english @xcite , but llms today often have capabilities in low-resource ones @xcite . we propose that many of these potential vulnerabilities can be viewed under a common umbrella, which we call the structural safety generalization problem. strong structural safety generalization is achieved if, for content in a semantic equivalence class, a safe response to one input guarantees a safe response to semantically equivalent inputs. in other words, safety generalizes over the equivalence class. for example, in the semantic equivalence class of language translation, instructions written in english should produce an equally safe response as the same instructions written in other languages. the same logic applies to equivalent instructions structured in one or multiple conversation turns, or structured as pure text vs. as a typographic image. semantic equivalence is a substantial constraint on the problem space, however, current ai systems remain very vulnerable to attacks within this constraint. for example, we show that splitting the same input text over multiple conversation turns changes safety, and so does putting part of the text in one or multiple typographic images. prior work has shown many other vulnerabilities like this, such as translation attacks where the same content can produce either safe or harmful responses depending on the language @xcite @xcite , or changing capitalization @xcite or tense @xcite of an input. therefore, to scope an even more solvable problem, we propose weak structural safety generalization with four constraining criteria that improve tractability of experiments and understanding: together, these criteria scope a problem that would be both immediately impactful to solvein that it would eliminate a large and pervasive set of jailbreaks -and a necessary condition to building robust models and safety in general. at the same time, each one represents a constraint that not only quantitatively narrows and focuses the problem, but also qualitatively makes it more tractable. to demonstrate this, we red-team several models within this framework and identify multiple new vulnerabilities, that have a linked data structure enabling comparative experiments and potentially new interpretability and defenses. we then blueteam our attacks and show how this perspective directly leads to a new structure rewriting (sr) guardrail. this guardrail transforms inputs from a figure 1 : an example of a multi-turn attack with caesar cipher. the single-turn equivalent of this attack combines all the user inputs into a single prompt. we show that safety does not generalize properly over this semantic equivalence class. in summary, we contribute: ## experiments prompt structure asymmetry averaged over all models, single-turn uni-modal attacks achieved an asr of 21.0%, while multi-turn uni-modal attacks achieved a slightly higher asr of 24.1%. multi-image multi-modal attacks showed a larger margin with an average asr of 28.4%, compared to single-image multi-modal attack's asr of 16.4%. in order to more definitively determine whether there is a qualitative difference between these attacks, we examine what percentage of attacks succeed in one structure but fail in the other. we refer to this as prompting structure asymmetry. figure 3(a) shows that there are a substantial number of attacks that successfully jailbreak the models in one turn but fail to do so in multiple turns, and vice versa. for example, 41.7% of successful attacks on claude 3 opus were attacks that succeeded in multi-turn format but failed in singleturn format; only 8.3% of successful attacks succeeded in single-turn format but failed in multi-turn format. figure @xcite suggests that models are outright more susceptible to multi-image attacks than singleimage attacks, and especially compared to text ones. the single exception here is gemini 1.5 flash, which held an asr of 47.3% against single image attacks and 42.3% against multi-image attacks ( overall, there is a substantial difference between structures. this shows both that there are novel vulnerabilities here, and that defending against one of these structures is no guarantee of defending against the rest. ## conclusion we have shown that frontier models are vulnerable to variations in prompting structure and modality, even when controlling for semantic meaning of the inputs. these new attacks present distinct threats, especially as capabilities like context window sizes and accepted modalities increase. but they are also part of an overall picture of structural vulnerabilities. despite equivalent semantics, safety systems are failing to generalize structurally. this is currently a grim conclusion. but if we could solve this generalization problem, then although there could still be many other attacks that leverage entirely different instructions, we could nonetheless immediately eliminate a great many threats. and it might also point to a more universal alignment solution, or at least serve as a stepping stone towards one. this perspective facilitates the creation of new datasets, like ours, with wellcontrolled and systematic setups to assess structural vulnerabilities. it also points towards new defense methods, like our sr guardrail, that leverage the semantic equivalence and explainabilityand therefore, understandability to llms -of these inputs. thus, we propose that this is a tractable perspective that can inform and provide a target and milestone for future research.