LLM-Agnostic Semantic Representation Attack

Abstract: LLMs increasingly employ alignment techniques to prevent harmful outputs. Despite these safeguards, attackers can circumvent them by crafting adversarial prompts. Predominant token-level optimization methods primarily rely on optimizing for exact affirmative templates (e.g., ``\textit{Sure, here is...}''). However, these paradigms frequently encounter bottlenecks such as suboptimal convergence, compromised prompt naturalness, and poor cross-model generalization. To address these limitations, we propose Semantic Representation Attack (SRA), a novel LLM-agnostic paradigm that fundamentally reconceptualizes adversarial objectives from exact textual targeting to malicious semantic representations. Theoretically, we establish the semantic Coherence-Convergence Relationship and derive a Cross-Model Semantic Generalization bound, proving that maintaining semantic coherence guarantees both white-box semantic convergence and black-box transferability. Technically, we operationalize this framework via the Semantic Representation Heuristic Search (SRHS) algorithm, which preserves interpretability and structural coherence of the adversarial prompts during incremental discrete token chunk expansion. Extensive evaluations demonstrate that our framework achieves a 99.71% average attack success rate across 26 open-source LLMs, with strong transferability and stealth.

• The paper introduces a paradigm shift by leveraging semantic representations to generate stealthy adversarial prompts against LLMs.
• It employs the SRHS algorithm and SRA+ technique to optimize prompt coherence and facilitate cross-model transferability with up to 100% success rate on open models.
• The work reveals critical weaknesses in token-level safety measures and sets groundwork for semantic-level defense strategies.

LLM-Agnostic Semantic Representation Attack: Foundational Advances in Semantic-Level Adversarial Prompting for Aligned LLMs

Introduction

This work defines a paradigm shift in adversarial attacks on aligned LLMs, introducing the Semantic Representation Attack (SRA) as a robust, LLM-agnostic framework for jailbreaking instruction-following LLMs. The SRA methodology moves beyond the constrained, brittle token-level adversarial triggers previously dominant—e.g., suffixes optimized to elicit rigid affirmative outputs such as "Sure, here is ..."—and instead crafts prompts targeting the underlying semantic representations responsible for harmful generation. By asserting that adversarial objectives should optimize for induced malicious meaning rather than specific lexical outputs, the framework achieves both stronger attack success and improved stealth by generating minimally perturbed, semantically coherent prompts that evade perplexity and heuristic-based safety filters.

Theoretical Framework and Paradigm Shift

The theoretical underpinning of SRA is a direct response to the suboptimality and poor generalization of token-level prompt attacks. Standard token-optimization strategies fail for three primary reasons: (1) the discrete, non-differentiable nature of token space yields intractable convergence and local minima, (2) the resultant adversarial prompts are syntactically incoherent, increasing their detectability, and (3) such prompts are strongly overfit and do not transfer to other architectures or API models.

SRA formalizes adversarial attack not as the search for a prefix that maximizes probability of an exact harmful response, but as the maximization of the probability mass for any output in the equivalence class $Y_\phi$ induced by a malicious semantic representation $\phi$. The search problem is thus expanded to cover the full distribution of semantically equivalent outputs—those with underlying meaning matching the attack goal—thereby significantly lowering computational and optimization constraints.

A central analytic result is Theorem III.1 (Coherence-Convergence Relationship), asserting that constraint of prompt-induced perplexity below a fixed threshold $T$ ensures any prompt $x$ generates not just a particular target, but a range of semantically equivalent malicious responses with bounded probability mass. This expands viable convergence paths, increasing the likelihood of attack success and stealth.

Further, Theorem III.2 (Semantic Generalization Bound) guarantees that semantic-level attacks maintaining prompt coherence lead to upper-bounded divergence between source/proxy LLM (on which the attack is optimized) and any target LLM, providing strong black-box and cross-model transferability.

Semantic Representation Heuristic Search (SRHS) and Proxy-Guided SRA+

To instantiate SRA practically, the authors propose the Semantic Representation Heuristic Search (SRHS) algorithm. SRHS incrementally expands candidate adversarial prompts by discrete token (or multi-token chunk), enforcing a perplexity (coherence) constraint at each step. The search is both efficient—drastically reducing combinatorial state space via early pruning—and interpretable, as generated suffixes remain grammatical and contextually plausible.

Adversarial prompt quality is evaluated using a dual-stage mapping: initial filtering via refusal-keyword heuristics, followed by a deep semantic representation classifier (fine-tuned Llama 2 13B), maximizing semantic veracity and efficiency.

As a further innovation, SRA+ is introduced: to overcome the peaked output distributions and localized safety fences of highly-aligned models such as Llama 2 series, the optimization is performed on a proxy model (e.g., Vicuna 7B) with a broader output distribution. This approach leverages the proxy’s semantic smoothness to discover adversarial directions that robustly transfer to rigid or heavily aligned architectures, bridging representational gaps and achieving near-universal transferability.

Experimental Results and Empirical Claims

Across comprehensive evaluation (26 open-source LLMs and leading closed-source APIs), SRA/SRA+ demonstrates a 99.71% average attack success rate on open models, especially surpassing previous baselines (e.g., GCG, AutoDAN, BEAST) even on architectures where others plateau (<60% ASR for Llama 2/3, DeepSeek, Qwen). SRA+ achieves ASR = 100% on 24/26 open-source models. These results empirically validate the theoretically-guaranteed transfer bounds.

For closed-source models, notably GPT-4.1 and GPT-5, SRA+ achieves non-trivial ASR (e.g., 18.67% on GPT-5, outperforming all prior approaches which remain at 0%), although outputs are often intercepted by external moderation layers.

SRHS produces highly compact adversarial suffixes (≤3 tokens), significantly shorter than prior approaches (GCG/AutoDAN), enhancing both runtime and stealth. Average runtime per attack is an order-of-magnitude lower than search-based token attacks due to the optimized search pruning and coherence constraint.

SRA demonstrates robustness against prompt-perturbation defences (SmoothLLM) and achieves high attack rates under stringent perplexity (PPL)-based filtering, a failure mode for prior methods that typically rely on unnatural token sequences.

Crucially, adversarial prompts remain fully grammatical and contextually appropriate, evading typical anomaly detection systems. Representative qualitative examples illustrate attacks that generalize across models and are indistinguishable from benign suffixes (e.g., “, while supporting”), yet induce complex chain-of-thought reasoning resulting in detailed, contextually relevant, and harmful outputs.

Implications for Alignment and Defence

This work exposes a fundamental limitation in alignment-by-surface-patterns: semantic coherence can be exploited to bypass most deployed refusal and safety strategies. Token-level safety and pattern matching are ineffective against attacks that leverage the abstract meaning space—especially if the safety finetuning data cannot span all semantically plausible adversarial reformulations.

Practical countermeasures will require a semantic-level analysis of intent and holistic contextual screening, rather than reliance on keyword heuristics or PPL-based anomaly detection.

Theoretically, SRA establishes the necessary groundwork for semantic-level vulnerability assessment tools for LLM safety evaluation, and for the development of new, model-agnostic red-teaming protocols.

Future Directions

The framework invites several lines of investigation:

• Semantic alignment: Safety training must adopt representationally-rich negative samples and semantic-level adversarial objectives.
• API-level defence: Robust moderation must operate post-generation, with semantic equivalence detection for harmful intent.
• Proxy selection and transfer calibration: Understanding when and why specific proxies yield maximal cross-model attack generalization may elucidate both offensive strategies and defensive model alignment regularization.
• Adaptive defences: The adoption of online, continual learning to detect emergent, high-coverage semantic vulnerabilities.

Conclusion

By shifting from token-level to semantic-level adversarial optimization, the SRA framework reveals the systemic vulnerability of aligned LLMs to coherent, transferable, minimally perturbed attacks. Both a practical system (SRHS, SRA+) and formal theory are provided, yielding essentially universal success against open-source LLMs and non-trivial breaches of heavily-guarded closed-source models. These findings necessitate an urgent evolution in the theory and practice of LLM alignment, with future research required in semantic-aware defence architectures and next-generation safety evaluation protocols.

Reference: "LLM-Agnostic Semantic Representation Attack" (2605.08898)