1 citations · 2 across the 14 of their papers we have counts for
9 papers · 1 filter
Unread or Unenforced? Separating Representation from Enforcement Failure in Content Guards
Haoyu Zhang, Yi Feng, Shibo Zheng +6
When an encoded attack passes a content guard, the guard either never represented the payload's harmful content or represented it and failed to act. End-to-end attack success rate…
Refusing Everything Looks Safe: Restoring the Benign Arm to Encoded-Prompt Evaluation
Haoyu Zhang, Haowen Xu, Xiao Luo +7
Encoded-prompt attacks are evaluated almost entirely on their harmful arm: a benchmark sends obfuscated harmful requests and reports how often the model complied. A high refusal ra…
The Uncontrolled Variable: Vision-Language Refusal Is Conditioned on the Image-Attachment Interface, and Not Robust to Irrelevant Image Properties
Haoyu Zhang, Yi Feng, Shibo Zheng +8
We show that aligned vision-language models also condition refusal on a property of a request's form: whether an image is attached, holding everything the request asks fixed. Attac…
0%, 45%, or 99%: A Guardrail's Own Share of the Refusals It Is Credited With
Haoyu Zhang, Xiangchen Guan, Xiao Luo +7
A defended pipeline's refusals have two producers: the guardrail bolted in front of the model, and the model's own alignment. Recovering the split costs nothing, because a guard bl…
Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks
Haoyu Zhang, Xiangchen Guan, Shibo Zheng +2
We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrela…
Blind, Not Weak: A Best-of-Suite Safety-Utility Frontier for Recover-and-Reguard Defenses Against Encoded VLM Jailbreaks
Haoyu Zhang, Zhuoxi Wang, Shibo Zheng +9
Safety classifiers ("guards") are the dominant black-box defense for vision-language models, yet a guard judges an input's surface form, not its meaning: a harmful request re-encod…
Depth, Not Breadth: Best-of-N Jailbreaking Beyond Surface Noise
Haoyu Zhang, Shibo Zheng, Hanwen Liu +9
Best-of-N jailbreaking spends a query budget on surface variation, scrambling and recasing a request until one draw lands. We ask what the same search buys when it wraps a structur…
Exposing LLM Safety Gaps Through Mathematical Encoding:New Attacks and Systematic Analysis
Haoyu Zhang, Mohammad Zandsalimy, Shanu Sushmita
Large language models (LLMs) employ safety mechanisms to prevent harmful outputs, yet these defenses primarily rely on semantic pattern matching. We show that encoding harmful prom…
Behind the Mask: Benchmarking Camouflaged Jailbreaks in Large Language Models
Youjia Zheng, Mohammad Zandsalimy, Shanu Sushmita
Large Language Models (LLMs) are increasingly vulnerable to a sophisticated form of adversarial prompting known as camouflaged jailbreaking. This method embeds malicious intent wit…