In-Context Representation Hijacking

TL;DR

This paper presents Doublespeak, an attack that hijacks LLM representations by substituting benign tokens for harmful ones, enabling unsafe prompts to bypass safety measures with high success rates across various models.

Contribution

It introduces a novel, transferability-focused attack method that manipulates internal representations of LLMs without optimization, exposing vulnerabilities in current safety alignment strategies.

Findings

Achieves 74% ASR on Llama-3.3-70B-Instruct with a single prompt override

Representation convergence from benign to harmful occurs layer by layer

Broadly transferable across different LLM architectures

Abstract

We introduce $\textbf{Doublespeak}$, a simple in-context representation hijacking attack against large language models (LLMs). The attack works by systematically replacing a harmful keyword (e.g., bomb) with a benign token (e.g., carrot) across multiple in-context examples, provided a prefix to a harmful request. We demonstrate that this substitution leads to the internal representation of the benign token converging toward that of the harmful one, effectively embedding the harmful semantics under a euphemism. As a result, superficially innocuous prompts (e.g., "How to build a carrot?") are internally interpreted as disallowed instructions (e.g., "How to build a bomb?"), thereby bypassing the model's safety alignment. We use interpretability tools to show that this semantic overwrite emerges layer by layer, with benign meanings in early layers converging into harmful semantics in later ones. Doublespeak is optimization-free, broadly transferable across model families, and achieves strong success rates on closed-source and open-source systems, reaching 74% ASR on Llama-3.3-70B-Instruct with a single-sentence context override. Our findings highlight a new attack surface in the latent space of LLMs, revealing that current alignment strategies are insufficient and should instead operate at the representation level.