用隐写术藏恶意指令，让大模型越狱攻击既有效又难被发现。
Hiding in Plain Sight: A Steganographic Approach to Stealthy LLM Jailbreaks
- 将恶意请求嵌入自然段落中，实现语义与语言双重隐蔽
- 在4个顶尖大模型上平均成功率95.50%，检测下下降不足27%
- 适合研究安全防御或对抗样本的学者参考
越狱攻击严重威胁大语言模型的安全性，其关键在于既要有效绕过安全机制，更要具备隐蔽性。现有方法难以兼顾语义隐蔽（隐藏恶意意图）与语言隐蔽（表现自然），易被检测。为此，我们提出StegoAttack框架，利用隐写技术将有害查询嵌入一个语义连贯的普通段落中。该设计通过隐藏恶意内容的存在实现语义隐蔽，并保持覆盖段落的语言流畅性以确保语言隐蔽。我们在四个最先进的安全对齐大模型（包括GPT-5和Gemini-3）上评估该方法，对比八种主流越狱手段。结果表明，StegoAttack平均攻击成功率达95.50%，在所有模型上均优于基线；在外部检测器下，其成功率仅下降小于27.00%，同时维持自然语言分布。这证明隐写术能有效解耦语言与语义隐蔽性，构成完全隐蔽且高效的新型安全威胁。代码已公开于https://github.com/GenggengSvan/StegoAttack。
原文摘要 · Abstract (English)
Jailbreak attacks pose a serious threat to Large Language Models (LLMs) by bypassing their safety mechanisms. A truly advanced jailbreak is defined not only by its effectiveness but, more critically, by its stealthiness. However, existing methods face a fundamental trade-off between semantic stealth (hiding malicious intent) and linguistic stealth (appearing natural), leaving them vulnerable to detection. To resolve this trade-off, we propose StegoAttack, a framework that leverages steganography. The core insight is to embed a harmful query within a benign, semantically coherent paragraph. This design provides semantic stealth by concealing the existence of malicious content and ensures linguistic stealth by maintaining the natural fluency of the cover paragraph. We evaluate StegoAttack on four state-of-the-art, safety-aligned LLMs, including GPT-5 and Gemini-3, and benchmark it against eight leading jailbreak methods. Our results show that StegoAttack achieves an average attack success rate (ASR) of 95.50%, outperforming existing baselines across all four models. Critically, its ASR drops by less than 27.00% under external detectors, while maintaining natural language distribution. This demonstrates that steganography effectively decouples linguistic and semantic stealth, thereby posing a fully concealed yet highly effective security threat. The code is available at https://github.com/GenggengSvan/StegoAttack
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。