Imperceptible Jailbreaking against Large Language Models (2510.05025v1)

Abstract: Jailbreaking attacks on the vision modality typically rely on imperceptible adversarial perturbations, whereas attacks on the textual modality are generally assumed to require visible modifications (e.g., non-semantic suffixes). In this paper, we introduce imperceptible jailbreaks that exploit a class of Unicode characters called variation selectors. By appending invisible variation selectors to malicious questions, the jailbreak prompts appear visually identical to original malicious questions on screen, while their tokenization is "secretly" altered. We propose a chain-of-search pipeline to generate such adversarial suffixes to induce harmful responses. Our experiments show that our imperceptible jailbreaks achieve high attack success rates against four aligned LLMs and generalize to prompt injection attacks, all without producing any visible modifications in the written prompt. Our code is available at https://github.com/sail-sg/imperceptible-jailbreaks.

• The paper introduces an imperceptible jailbreak that uses invisible Unicode variation selectors to modify tokenization and bypass LLM alignment.
• The chain-of-search pipeline iteratively optimizes secret adversarial suffixes, achieving up to 100% success rates on several models.
• Empirical results show that attention shifts from harmful content to invisible suffixes, exposing a critical vulnerability in LLM safety filters.

Imperceptible Jailbreaking of LLMs via Invisible Unicode Variation Selectors

Introduction

This work introduces a new class of adversarial attacks—imperceptible jailbreaks—against aligned LLMs. Unlike prior textual jailbreaks that rely on visible prompt modifications, this approach leverages Unicode variation selectors, a set of invisible characters, to construct adversarial suffixes. These suffixes are appended to malicious questions, resulting in prompts that are visually indistinguishable from the originals but are tokenized differently by LLMs. The attack is optimized via a chain-of-search pipeline, which iteratively refines invisible suffixes to maximize the likelihood of harmful completions. The method is evaluated on four open-source aligned LLMs, demonstrating high attack success rates (ASRs) and generalization to prompt injection scenarios, all without visible prompt alterations.

Figure 1: An illustrative comparison between an original malicious question and an imperceptible jailbreak prompt. Both appear identical on screen, but the jailbreak version includes invisible variation selectors, which are encoded as additional tokens by LLM tokenizers.

Unicode Variation Selectors as an Adversarial Vector

Unicode variation selectors are a set of 256 codepoints (U+FE00–U+FE0F and U+E0100–U+E01EF) originally intended to modify the rendering of special characters (e.g., emoji variants). When applied to standard alphabetic characters, these selectors have no visual effect, but they persist in the underlying text and are processed by LLM tokenizers as valid tokens.

Figure 2: Variation selectors alter the appearance of special characters but are invisible when appended to standard characters, enabling imperceptible jailbreaks.

This property enables the construction of adversarial suffixes that are undetectable to human readers but can manipulate the model’s internal representations. The attack exploits the fact that LLM tokenizers encode these invisible characters, thus altering the input sequence at the token level without any perceptible change at the character level.

Chain-of-Search Pipeline for Invisible Suffix Optimization

The optimization of invisible adversarial suffixes is formulated as a random search problem. For a given malicious question $Q$, a suffix $S$ of $L$ variation selectors is appended, forming $P = Q \circ S$. The search iteratively mutates $M$ contiguous variation selectors within $S$, accepting changes that increase the log-likelihood of a target-start token (e.g., "Sure") in the model’s output.

A key challenge is the limited search space: most variation selectors are mapped to multi-token blocks, and their effect is not as granular as visible character-level modifications. To address this, the chain-of-search pipeline bootstraps the optimization by reusing successful suffixes and target-start tokens across multiple rounds and failed questions, enabling transfer of adversarial components and improving convergence.

Figure 3: Comparison of jailbreak prompt construction for simple adaptive attacks, $\mathcal{I}$-GCG, and imperceptible jailbreaks. Only the latter uses invisible variation selectors, resulting in visually identical prompts.

Empirical Evaluation

Attack Success Rates

The method is evaluated on Vicuna-13B-v1.5, Llama-2-Chat-7B, Llama-3.1-Instruct-8B, and Mistral-7B-Instruct-v0.2 using 50 malicious questions from AdvBench. The imperceptible jailbreaks achieve ASRs of 100% on Vicuna-13B-v1.5, 98% on Llama-2-Chat-7B, 80% on Llama-3.1-Instruct-8B, and 100% on Mistral-7B-Instruct-v0.2. These results are competitive with or superior to state-of-the-art visible jailbreaks, despite the attack being entirely invisible.

Target-Start Token and Round Distribution

Analysis of successful jailbreaks reveals model-specific preferences for target-start tokens. For example, Vicuna-13B-v1.5 and Llama-2-Chat-7B favor "Sure" and "Here", while Mistral-7B-Instruct-v0.2 often begins with "1" or "Title", reflecting a bias toward list- or title-style completions.

Figure 4: Distribution of target-start tokens for successful jailbreaks across four aligned LLMs, highlighting model-specific response format preferences.

The chain-of-search pipeline is effective, with most successful jailbreaks occurring within the first two rounds for Vicuna-13B-v1.5 and Mistral-7B-Instruct-v0.2, and in later rounds for Llama-2-Chat-7B and Llama-3.1-Instruct-8B.

Figure 5: Distribution of round numbers for successful jailbreaks, demonstrating the effectiveness of the chain-of-search pipeline.

Hyperparameter Ablation

Ablation studies on suffix length $L$ and number of modified characters $M$ indicate that moderate values (e.g., $L=800$, $M=10$) yield optimal performance for most models, balancing search space size and optimization stability.

Figure 6: Ablation on suffix length $L$ and number of modified characters $M$; moderate values optimize effectiveness and stability.

Model Internals: Attention and Embedding Divergence

Contrastive Input Erasure (CIE) analysis shows that, for original malicious questions, model attention is focused on harmful phrases, promoting refusal. Under imperceptible jailbreaks, attention shifts to the invisible suffix, reducing focus on harmful content and bypassing alignment.

Figure 7: Attention score distribution under imperceptible jailbreaks. Attention shifts from harmful content to invisible suffixes, facilitating alignment bypass.

t-SNE visualization of embedding features reveals a clear separation between original and imperceptible jailbreak prompts, confirming that invisible suffixes induce significant changes in the model’s internal representations.

Figure 8: Embedding divergence under imperceptible jailbreaks; invisible suffixes create distinct embedding clusters, supporting attack effectiveness.

Generalization to Prompt Injection

The attack generalizes to prompt injection tasks, achieving 100% ASR in causing models to execute attacker-injected tasks instead of user-intended ones, even with a single target-start token and no restarts.

Implications and Limitations

This work exposes a critical vulnerability in current LLM alignment mechanisms: invisible Unicode characters can be adversarially optimized to bypass safety filters without any visible trace. The attack is robust across multiple model architectures and generalizes to prompt injection. The findings suggest that alignment strategies relying solely on visible prompt inspection or output filtering are insufficient.

Potential mitigations include perplexity-based input filtering and output harmfulness probes, but these may be circumvented by adaptive attacks leveraging invisible characters. The results motivate further research into tokenizer-level input sanitization, robust alignment techniques, and detection of imperceptible adversarial perturbations.

Conclusion

Imperceptible jailbreaks using invisible Unicode variation selectors represent a novel and effective attack vector against aligned LLMs. The chain-of-search pipeline enables efficient optimization of invisible adversarial suffixes, achieving high ASRs while maintaining visual indistinguishability. The attack’s success across multiple models and its generalization to prompt injection highlight the need for more comprehensive defenses at the tokenizer and alignment levels. Future work should explore adaptive detection and mitigation strategies for invisible adversarial manipulations in LLM pipelines.