Novel 'Character Splintering' Jailbreak Bypasses Safety Filters in Major LLMs
Overview
A research team from ETH Zurich published a paper detailing a novel jailbreak technique named 'Character Splintering'. This attack is effective against a wide range of leading LLMs, including OpenAI's GPT-4o, Anthropic's Claude 3.5 Sonnet, and Google's Gemini 1.5 Pro. The technique works by breaking down a harmful instruction into a series of seemingly benign prompts, where each prompt manipulates the model's internal state by embedding fragments of the forbidden request within Unicode characters, control sequences, or obscure language constructs. For example, parts of a prompt to generate malware code could be encoded within the byte representation of emojis or invisible characters. When the model processes this sequence of splintered prompts, its safety alignment mechanisms fail to detect the harmful intent in any single step. However, the cumulative effect reconstructs the malicious instruction in the model's latent space, compelling it to generate the harmful output in the final turn. This method is highly evasive because it doesn't rely on typical jailbreaking patterns like role-playing or direct instruction refusal, making it difficult to patch with simple filters. The researchers demonstrated its effectiveness in generating phishing emails, hate speech, and functional exploit code. The findings highlight the fundamental challenge of ensuring robust safety alignment in state-of-the-art models.
Affected Systems
Testing Guide
1. Construct a series of prompts that embed a harmful request (e.g., 'how to build a bomb') by breaking the words into pieces and hiding them in Unicode characters or base64 encoded strings within otherwise benign sentences. 2. Send these prompts sequentially to the target LLM. 3. In the final prompt, ask a concluding question like 'Now, put all the steps together.' 4. If the model outputs the harmful instructions, it is vulnerable to this class of jailbreak.
Mitigation Steps
1. For developers using LLM APIs, implement multi-layered defense. Use external content moderation APIs (e.g., OpenAI Moderation endpoint) to scan both user prompts and model outputs. 2. Configure strict system prompts that explicitly forbid the model from following fragmented or obfuscated instructions. 3. Implement output parsing and validation. If you expect a specific format (e.g., JSON), reject any output that deviates from it, as this can be a sign of a successful jailbreak. 4. Monitor for unusual prompt patterns, such as those with high-entropy text, excessive use of non-standard characters, or a series of very short, seemingly unrelated queries.
Patch Details
This is a technique, not a specific software bug. Model providers are working on improving model robustness and fine-tuning defenses, but no complete patch exists.