Research map / Large language models / Language, safety and interpretability

Assessing Vulnerabilities in State-of-the-Art Large Language Models Through Hex Injection (Student Abstract)

AAAI 2025 · Large language models › Language, safety and interpretability · approach: Jailbreak attacks and defenses · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Hex Injection (HXI), a jailbreak that hex-encodes harmful prompts and wraps them in role-play prefixes/suffixes, and reports high attack success rates against Llama 3/3.1 and Gemma 2 models.

Problem

Safety-aligned LLMs can be jailbroken; the paper targets weaknesses in models' ability to decode encoded (hexadecimal) text to bypass safeguards and elicit harmful content.

Approach

Combine hexadecimal-encoded harmful topics with plaintext role-play prefixes and suffixes so that the model decodes and executes the hidden instruction, which is more effective than plaintext or encoding-only prompts.

Key results

• Hex Injection with role-play jailbroke Llama 3.1:70b on 94% (47/50) of prompts and Gemma 2:27b on 86% (43/50).
• Llama 3.1:8b was jailbroken on 0% of HXI prompts (0/200), while Llama 3:8b reached 17%.
• Without HXI, plaintext prompts succeeded on only 0-6% of Llama prompts but 74% for Gemma 2:27b.

Measured effects reported in the paper

Surprising findings

• Larger models (70b) were more vulnerable to hex-encoded attacks than smaller 8b models, because smaller models often failed to decode the prompt correctly.
• Gemma 2:27b was jailbroken on 74% of plaintext prompts even without encoding.

Limitations

• Success judged by manual review of outputs rather than an automated or standardized judge.
• Small evaluation set (50 prompts per model for most configurations) with no reported variance.
• Role-play framing and attack details are described only qualitatively; no code or prompts released.

Experimental setup

Datasets: 50 harmful prompts from a public Llama3-jailbreak repository (haizelabs)

Benchmarks: Harmful prompt set (50 prompts from haizelabs Llama3-jailbreak)

Metrics: attack success rate (% jailbroken)

Baselines: Plaintext prompts (no HXI)

Builds on: CodeChameleon

Closest papers by meaning

• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.88)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.88)
• Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs (ICML 2025 · similarity 0.88)
• Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment (CVPR 2025 · similarity 0.88)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.88)
• CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion (NeurIPS 2026 · similarity 0.88)