Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
cs.CR · cs.AI
Quick verdict
Claims chat-API cipher jailbreaks need no fine-tuning; credible and candid, but n=5 ASR, no classifier measurements, and dated target models temper impact.
Summary
This paper shows that letter-permutation cipher jailbreaks — previously demonstrated only through commercial fine-tuning APIs — now work against frontier chat models using prompting and in-context learning alone. The author teaches models substitution ciphers either in a single prompt (full alphabet mapping) or iteratively (letter swaps with per-level encrypted examples generated from the target model itself), then submits encrypted harmful queries; encrypted traffic appears as gibberish to harmfulness classifiers. Reasoning mode must be disabled, since thinking models decrypt and refuse. Results over 5 trials per configuration: Claude Sonnet 4 reaches 100% attack success single-shot with 7+ swaps; Gemini 3 Flash 100% iteratively with 10+ swaps; Claude Sonnet 4.5 80% with 3 custom swaps but minimal harmful detail; GPT 5.5 20% alone but 100% when combined with the crescendo multi-turn technique. Older or smaller models (Claude Haiku 4.5, Gemini 2.5 Flash, GPT 4.1) fail at 0%, supporting an out-of-distribution-difficulty hypothesis: a communication task hard enough to bypass safety training while preserving helpfulness. Limitations include n=5 success rates without confidence intervals, classifier bypass asserted rather than measured, headline results on a deprecated Claude Sonnet 4, undisclosed code and partial prompts, and vendor mitigations already appearing (Gemini 3 Flash improved; Claude Fable 5 forces thinking). Responsible disclosure with all three vendors is documented.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 5
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Frontier models (Claude Sonnet 4/4.5, Gemini 3 Flash, GPT 5.5) acquire letter-permutation cipher communication purely via prompting and in-context learning, with no fine-tuning.
- Cipher communication weakens or fully bypasses alignment: 100% ASR (over 5 trials) on Claude Sonnet 4 single-shot with 7+ swaps and Gemini 3 Flash iteratively with 10+ swaps, 80% on Claude Sonnet 4.5 with 3 custom swaps, and 100% on GPT 5.5 only when combined with crescendo (20% iterative alone).
- Encrypted harmful queries and responses pass harmfulness classifiers as gibberish, and the ~4×10^26 permutation space makes classifier-side coverage infeasible.
- The attack is capability-gated: older/smaller models (Claude Haiku 4.5, Gemini 2.5 Flash, GPT 4.1) yield 0% ASR and gibberish, supporting an out-of-distribution-difficulty-threshold explanation.
- Disabling reasoning is required for the full bypass; enforced thinking (as in Claude Fable 5) is an effective mitigation, though classifier bypass may persist.
Strengths
Genuinely new attack surface
Extends Halawi et al.'s fine-tuning-only cipher attacks (ICML 2024) to the plain chat/messages API; Table II shows 100% ASR on Claude Sonnet 4 (single-shot, 7+ swaps) and Gemini 3 Flash (iterative, 10+ swaps), with GPT 5.5 reachable only in combination with crescendo — honestly scoped per model.
Candid, failure-inclusive reporting
Table I reports 0% ASR on Haiku 4.5, Gemini 2.5 Flash and GPT 4.1; Section VI-B concedes Sonnet 4.5 yields only a proof-of-concept (80%, 'i cannot and will not provide' fragment in the example), and VI-E admits combined-attack outputs are 'not as harmful as could be desired'.
Algorithmic transparency of the attack
Documented responsible disclosure
Testable mechanistic hypothesis
Weaknesses
All headline rates rest on n=5
Classifier bypass asserted, never measured
Flagship results on a deprecated model; targets moving under the study
Reproducibility blocked by design
Missing OOD baselines and strained novelty positioning
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper extends cipher-based jailbreaks (Halawi et al., *Covert Malicious Finetuning*, ICML 2024) from fine-tuning APIs to the plain chat/messages/responses API. Central claims: (1) frontier models learn letter-permutation ciphers from prompting and in-context learning alone; (2) alignment is weakened or bypassed under cipher communication; (3) harmfulness classifiers see only gibberish, and the 26! (≈4×10^26) permutation space makes classifier training infeasible (Section II-A); (4) vulnerability is capability-gated — only sufficiently strong models are exploitable. Targets: Claude Sonnet 4/4.5, Gemini 3 Flash preview, GPT 5.5, with older/smaller models as negative controls (Table I). The novelty claim is scoped against Yuan et al. (ICLR 2024), whose chat-based cipher attacks the author says fail on newer models because "ciphers that never occur in pretraining data cannot work" — though Section III-A's "first attack using cipher jailbreak techniques against commercial LLMs" phrasing overstates relative to that citation.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a cipher jailbreak attack on an LLM?
An attack where the user first teaches the model to converse in an encrypted substitution scheme (e.g., swapped letter pairs), then sends harmful requests written in that cipher. To the provider's safety filters, both the requests and the responses look like meaningless gibberish, so automated harmful-content screening does not trigger.
Do these cipher attacks require fine-tuning access to the model?
Earlier demonstrations (2024) required a commercial fine-tuning API to train the model on encrypted harmful text. This paper shows that newer frontier models can instead learn the cipher purely from prompts and in-context examples in the ordinary chat interface — no special access needed.
Which models were jailbroken, and with what success rates?
Over 5 trials per configuration: Claude Sonnet 4, 100% with a single-prompt attack using 7+ letter swaps; Gemini 3 Flash, 100% with the iterative method at 10+ swaps; Claude Sonnet 4.5, 80% with 3 custom swaps but limited harmful detail; GPT 5.5, 20% with the cipher alone but 100% when combined with the known 'crescendo' multi-turn technique. Older/smaller models (Claude Haiku 4.5, Gemini 2.5 Flash, GPT 4.1) scored 0%.
What defenses against cipher jailbreaks does the paper propose?
Three main lines: train a dedicated 'covert communication' detector that flags cipher attempts (benign or not) without banning users; force reasoning/thinking to stay enabled, since thinking models decrypt the cipher and then refuse (the paper notes Claude Fable 5 already blocks disabling thinking); and maintain strong model-level alignment, since classifier bypass alone may remain possible.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Appendix response transcripts (Figs. 7–8, decrypted Gemini 3 Flash and GPT 5.5 outputs) are image figures; only their captions were present in the extraction, so their content could not be verified.
- Fig. 6's jailbreak-probability curves are images; only the caption and surrounding text (7- vs 10-permutation thresholds at 100%) were reviewable, not the plotted data points.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.