AJF: Adaptive Jailbreak Framework Based on the Comprehension Ability of Black-Box Large Language Models

TL;DR

This paper introduces AJF, an adaptive framework that exploits the comprehension abilities of black-box LLMs to effectively bypass their alignment safeguards through tailored attack strategies.

Contribution

The paper presents a novel adaptive jailbreak framework that categorizes LLMs by comprehension ability and applies customized attack strategies, significantly improving attack success rates.

Findings

Achieved 98.9% success rate on GPT-4o

Achieved 99.8% success rate on GPT-4.1

Demonstrated the effectiveness of adaptive strategies based on comprehension ability

Abstract

Recent advancements in adversarial jailbreak attacks have exposed critical vulnerabilities in Large Language Models (LLMs), enabling the circumvention of alignment safeguards through increasingly sophisticated prompt manipulations. Our experiments find that the effectiveness of jailbreak strategies is influenced by the comprehension ability of the target LLM. Building on this insight, we propose an Adaptive Jailbreak Framework (AJF) based on the comprehension ability of black-box large language models. Specifically, AJF first categorizes the comprehension ability of the LLM and then applies different strategies accordingly: For models with limited comprehension ability (Type-I LLMs), AJF integrates layered semantic mutations with an encryption technique (MuEn strategy), to more effectively evade the LLM's defenses during the input and inference stages. For models with strong comprehension ability (Type-II LLMs), AJF employs a more complex strategy that builds upon the MuEn strategy by adding an additional layer: inducing the LLM to generate an encrypted response. This forms a dual-end encryption scheme (MuDeEn strategy), further bypassing the LLM's defenses during the output stage. Experimental results demonstrate the effectiveness of our approach, achieving attack success rates of \textbf{98.9\%} on GPT-4o (29 May 2025 release) and \textbf{99.8\%} on GPT-4.1 (8 July 2025 release). Our work contributes to a deeper understanding of the vulnerabilities in current LLMs alignment mechanisms.