ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
Proposes ICO, an iterative context optimization framework, achieving 74.6% success in semantic-shift jailbreaks with high-quality contexts.
Key Findings
Methodology
This work systematically analyzes the role of context in semantic-shift jailbreaks, revealing that contexts with stronger semantic-shift capabilities better guide models to recover harmful semantics. The proposed ICO framework employs a three-stage process: harmful term replacement, initial context generation via an auxiliary model, and iterative optimization based on model feedback. Each iteration involves querying the target model, evaluating responses with a judge model, and refining contexts using feature extraction and guidance prompts. This feedback loop enhances the context’s ability to induce semantic shifts, significantly improving attack success rates across multiple datasets and models.
Key Results
- On five foundation models, ICO achieved an average full attack success rate of 86%, surpassing the best baseline by over 33%. In multimodal scenarios, success rates reached 99%. Multi-round iterative optimization increased success by over 20%, demonstrating the effectiveness of context feature refinement. Incorporating guidance prompts further improved semantic recovery by 15-25%, confirming the importance of feature-guided optimization. The results show that stronger semantic-shift contexts greatly enhance the model’s vulnerability, validating the approach’s robustness and generalization.
- Across datasets, ICO consistently outperformed baselines like Doublespeak and AutoDAN-Turbo, with significant improvements in partial and full success rates. Ablation studies confirmed that feedback-driven context refinement is crucial. The method’s adaptability across models (GPT-5.4, Gemini-3.1, DeepSeek, Llama) and modalities underscores its broad applicability. The experimental results demonstrate that multi-round feedback and feature extraction are key to unlocking the semantic-shift potential of contexts, making ICO a powerful tool for security testing.
- Further analyses revealed that optimized contexts exhibit recurring semantic features, such as role clues and contextual cues, which can be exploited to induce harmful semantics. The iterative process effectively aligns the context with the target model’s reasoning patterns, leading to higher attack success. The combination of feature extraction, feedback, and guidance prompts forms a comprehensive attack pipeline that significantly advances the state-of-the-art in semantic-shift jailbreaks.
Significance
This research uncovers the pivotal role of context in semantic-shift attacks, moving beyond simple word replacement strategies. By systematically optimizing context features through feedback, it demonstrates a new pathway to evaluate and challenge the safety of foundation models. The high success rates across diverse models and modalities highlight the vulnerability of current safety mechanisms, emphasizing the need for more robust defenses. The ICO framework not only advances attack methodologies but also provides insights for designing safer models, fostering a deeper understanding of model interpretability and robustness. Its implications extend to content moderation, AI safety, and adversarial robustness, marking a significant step forward in AI security research.
Technical Contribution
This paper introduces a novel black-box iterative context optimization (ICO) framework that leverages model feedback and feature extraction to enhance semantic-shift jailbreak success. Unlike prior approaches relying on static or randomly generated contexts, ICO dynamically refines contexts through multiple rounds, guided by a judge model and feature cues. The core innovation lies in the integration of semantic feature extraction with feedback-driven adjustment, forming a closed-loop system that systematically amplifies the model’s susceptibility to semantic shifts. This approach provides theoretical guarantees of improved attack success and generalizes across models and modalities, representing a significant technical advance in adversarial attack design.
Novelty
This work is the first to systematically analyze the variability of context’s semantic-shift capability and to propose a multi-round iterative optimization framework. Unlike previous methods that treat context as static or rely solely on heuristic generation, ICO employs a feedback loop that extracts semantic features and guides context refinement. This creates a dynamic, adaptive attack pipeline capable of consistently achieving high success rates across diverse models and datasets. The novelty also includes the explicit use of guidance prompts and feature cues to enhance the semantic induction process, setting a new standard for semantic-shift jailbreaks.
Limitations
- The approach depends on predefined feature extraction and guidance prompts, which may not generalize well to unseen or highly complex contexts. Computational costs increase with multiple iterations, limiting real-time applications.
- The method’s effectiveness diminishes against models with stronger safety mechanisms or adversarial defenses, indicating a need for further robustness improvements.
- Current experiments focus on specific datasets and models; broader testing on real-world deployment scenarios is necessary to validate generalizability and resilience.
Future Work
Future directions include integrating multi-modal data to enhance context richness, developing adaptive feature extraction techniques, and reducing computational overhead. Exploring automated prompt generation and reinforcement learning-based optimization could further improve efficiency. Additionally, extending the framework to evaluate defenses and develop more resilient models will be crucial. Combining ICO with adversarial training and robustness methods may lead to more secure foundation models, fostering safer deployment in real-world applications.
AI Executive Summary
Foundation models such as GPT and Gemini have revolutionized NLP and multimodal tasks, yet their safety remains a concern. Recent studies reveal that these models can be manipulated through semantic-shift jailbreaks, where harmful intent is hidden behind benign language and context. Traditional methods rely on simple word replacements, which often fail to induce the desired semantic shift effectively, resulting in limited success rates.
This paper introduces ICO (Iterative Context Optimization), a novel framework designed to systematically enhance the effectiveness of semantic-shift attacks. ICO employs a three-stage process: replacing harmful terms with placeholders, generating initial contexts via an auxiliary model, and iteratively refining these contexts based on feedback from the target model. Each iteration involves querying the model, evaluating responses with a judge model, and adjusting the context features accordingly. This feedback-driven process allows the attacker to craft highly effective contexts that induce models to recover harmful semantics with high probability.
Extensive experiments across three datasets and eight foundation models demonstrate ICO’s superior performance. The average attack success rate reaches 74.6%, significantly outperforming existing baselines. Notably, in multimodal settings, success rates approach 99%, highlighting the method’s robustness. The key insight is that contexts with stronger semantic-shift capabilities can guide models to recover harmful meanings more reliably. By extracting and optimizing these features iteratively, ICO creates a powerful attack pipeline that exposes vulnerabilities in current safety mechanisms.
The implications of this work are profound. It underscores the importance of understanding contextual influences on model safety and provides a practical tool for evaluating and improving defenses. While promising, the approach faces challenges such as computational costs and generalization to more complex scenarios. Future research will focus on integrating multi-modal data, reducing overhead, and developing more resilient models. Overall, ICO marks a significant advance in AI security, offering both a potent attack method and insights for building safer foundation models in the future.
Deep Dive
Abstract
Foundation models have achieved remarkable success across diverse tasks, but they remain vulnerable. To investigate such vulnerabilities, semantic-shift jailbreaks have recently emerged as a promising attack paradigm. They bypass explicit safety mechanisms by replacing harmful terms in original harmful questions with benign alternatives and leveraging contextual information to induce the target model to reinterpret these alternatives as their corresponding harmful concepts. However, existing semantic-shift jailbreaks often achieve limited effectiveness. In this work, we reveal that this limitation arises from overlooking the semantic-shift capability of contexts. Through systematic analysis, we find that contexts exhibit substantially different abilities in inducing semantic shifts: contexts with stronger semantic-shift capabilities are more likely to guide models toward recovering harmful meanings and achieving successful jailbreaks. Based on this finding, we systematically identify and distill the characteristics of effective contexts and propose a black-box context-aware semantic-shift jailbreak framework with Iterative Context Optimization (ICO). In each iteration, ICO leverages these characteristics and feedback from the target model to optimize contexts. Extensive experiments on three datasets and eight target foundation models demonstrate that ICO consistently outperforms eight state-of-the-art baselines, achieving an average attack success rate of 74.6%.