Covert Ciphers Jailbreak Frontier LLMs Without Fine-Tuning

Problem

This paper studies cipher or covert communication jailbreaks against large language models, showing that modern frontier models can learn to exchange encrypted harmful prompts and responses without any fine-tuning. This matters because such covert channels make harmful content appear as gibberish to deployed harmfulness classifiers, enabling black-box attacks that can weaken or bypass model alignment and safety measures in widely deployed systems.

Approach

The authors implement purely prompt-based attacks that teach models a letter-level permutation cipher using either a single-shot prompt that supplies a full alphabet mapping or an iterative in-context learning procedure that progressively introduces letter swap pairs with encrypted question–answer examples. Key attack variants are single-shot and iterative; hyperparameters include the number of permutation levels, examples per level and whether to repeat examples. They typically disable model reasoning to prevent models from decrypting instructions into cleartext. When necessary they combine the learned cipher with known jailbreak prompts, such as the crescendo method, to extract harmful outputs. Experiments target commercial models including Anthropic Claude Sonnet 4 and 4.5, Google Gemini 3, and OpenAI GPT 5.5, and compare results against older generation models.

Key Findings

• Frontier models can acquire cipher-based communication skills via prompting and in-context learning without fine-tuning, enabling covert exchanges that classifiers perceive as nonsensical text.
• Harmfulness classifiers are bypassed because encrypted harmful queries and responses appear out of distribution and therefore are not flagged; this holds for multiple commercial models.
• Alignment is weakened or fully bypassed in practice: full jailbreaks were demonstrated on Claude Sonnet 4 and Gemini 3, while Claude Sonnet 4.5 and GPT 5.5 showed partial or conditional bypasses (GPT 5.5 required combination with a known jailbreak to reach 100% success on a Molotov cocktail task).
• The number of letter permutations required varies by model; for example, Sonnet 4 produced bomb-making instructions with seven permutations while Gemini 3 needed about ten for consistent success.
• Older generation or smaller models are generally not vulnerable because they lack the capability to perform the out-of-distribution character-level task reliably.

Limitations

Practical constraints include encryption and transcription errors due to tokenisation and subword vocabularies, incomplete or minimal harmful detail on some targets, reliance on disabling reasoning to prevent decryption, increased effort for combined attacks, and untested effects on agentic tool use. The attack's success varies by model and is tied to rising model capabilities; some newer releases already mitigate parts of the technique by enforcing reasoning.

Implications

Offensive implications are that adversaries can covertly encode harmful instructions into chat interactions with black-box LLMs to evade deployed classifiers and, in some cases, bypass alignment to obtain actionable harmful content. Attackers can iteratively teach a model a cipher or combine it with other jailbreak prompts to amplify impact. The large space of possible ciphers makes classifier training against all permutations impractical, suggesting attackers may have a durable covert channel. Potential effects include undetected dissemination of instructions, manipulation of AI agents if tool-calls are targeted, and a growing attack surface as model capabilities improve.