Attack Reframing Strategies

• Attack reframing is a technique where adversaries shift the presentation of harmful content using narrative, contextual, syntactic, or geometric modifications.
• It employs methods such as prompt rewriting in LLMs, adversarial framing in images, and manipulation of state-estimation systems to bypass conventional defenses.
• Defensive strategies include contextual analysis, dynamic input sanitization, and robust detector mechanisms, highlighting both technical and social security challenges.

Attack reframing denotes a family of adversarial strategies in which the underlying harmful objective is preserved while its presentation, context, carrier, or apparent source is changed. In the supplied literature, this operation appears in several technically distinct forms: social-media actors may adjust the narrative and focus of a campaign to appeal to a larger audience; LLM attackers may rewrite an explicitly unsafe query into an innocuous-looking variant that still carries the same malicious intent; a malicious objective may be decomposed into permissible objectives and linked through implicit references within context; a hidden malicious event may be concealed as the climax of a three-act narrative; an image may be left unchanged except for an adversarial framing on the border; and a control-center detector may be induced to frame correct meters as bad data (Elmas et al., 2021, Sakib et al., 20 May 2026, Wu et al., 2024, Guo et al., 30 Sep 2025, Zolna et al., 2018, Kim et al., 2013).

1. Uses of framing and reframing across research areas

The supplied literature does not present a single unified formalism for attack reframing. Instead, it uses related terminology for operations that shift where the adversarial signal is located, how it is represented, or which component of the system appears culpable. In some settings the reframing is narrative and social; in others it is syntactic, contextual, multimodal, geometric, or forensic.

Setting	Reframing mechanism	Representative paper
Online disinformation	“adjusted the narrative and focus” / “tactical reframing”	(Elmas et al., 2021)
LLM jailbreaks	“rewrite an explicitly unsafe query into an innocuous-looking variant” / “Attack via Implicit Reference” / “memory reframing”	(Sakib et al., 20 May 2026, Wu et al., 2024, Xiao et al., 2024)
Multimodal and vision attacks	“hidden climax” / “adversarial framing on the border of the image”	(Guo et al., 30 Sep 2025, Zolna et al., 2018)
Power-system state estimation	“frames meters that are providing correct data as sources of bad data”	(Kim et al., 2013)
Abstract argumentation	attack translated to $x\to\neg y$	(Gabbay et al., 2015)

A recurring pattern is that reframing does not necessarily weaken the adversarial objective. The objective may remain semantically aligned with unsafe content, even when the observable input looks benign, peripheral, or procedurally justified. This is explicit in prompt-rewriting attacks that optimize safety gain under semantic-similarity constraints, in contextual attacks that rely on in-context recovery of omitted fragments, and in state-estimation attacks that weaponize the defender’s own bad-data pipeline.

2. Tactical narrative shifts in online disinformation

In the case study on the Istanbul Convention, reframing is explicitly social and rhetorical rather than algorithmic. The paper traces disinformation campaigns related to the Istanbul Convention and its associated Turkish law circulating on divorced men’s rights Facebook groups. It reports that these groups adjusted the narrative and focus of the campaigns to appeal to a larger audience, and refers to this as “tactical reframing” (Elmas et al., 2021).

The reported sequence is specific. Initially, the men organized in a grass-roots manner to campaign against the Turkish law that was passed to codify the convention, focusing on one-sided custody of children and indefinite alimony. Later, they reframed their campaign and began attacking the Istanbul Convention, highlighting its acknowledgment of homosexuality. The paper states that this case study highlights how disinformation campaigns can be used to weaponize homophobia in order to limit the rights of women (Elmas et al., 2021).

In this setting, reframing changes the attack surface from a relatively narrow grievance to a broader symbolic target. A plausible implication is that reframing serves not merely to restyle an existing message but to increase coalition size by shifting the issue definition itself. The abstract also describes the work as, to the best of the authors’ knowledge, the first case study that analyzes a narrative reframing in the context of a disinformation campaign on social media (Elmas et al., 2021).

3. Prompt, context, and memory reframing in LLM jailbreaks

In LLM security, reframing is formalized most directly in adversarial prompt rewriting. THREAT defines adversarial reframing as learning a parametric reframing function $f_\theta:\mathcal{P}\to\mathcal{P}$ such that, for an unsafe seed $x_0$, the rewritten prompt $x^*=f_\theta(x_0)$ still conveys the same harmful intent but yields a much larger safety score and elicits a non-refusal response. The paper introduces semantic similarity

$S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$

and reward safety gain

$R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$

then formulates the search as

$$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$

THREAT uses a generator LLM and an evaluator in a closed loop, with $L=5$ variations per iteration, $\epsilon_1=0.05$, $\epsilon_2=0.98$, $f_\theta:\mathcal{P}\to\mathcal{P}$0, and $f_\theta:\mathcal{P}\to\mathcal{P}$1 up to 10. The paper states that the problem is nonconvex because both the objective and feasible region are nonconvex, and reports refusal rates on GPT-4o falling from roughly 40–60% to below 1% across four benchmarks, with white-box ASR values of $f_\theta:\mathcal{P}\to\mathcal{P}$2 on LLaMA-2-7B, $f_\theta:\mathcal{P}\to\mathcal{P}$3 on LLaMA-3-8B-RR, and $f_\theta:\mathcal{P}\to\mathcal{P}$4 on Mistral-7B-v2-RR (Sakib et al., 20 May 2026).

AIR, or Attack via Implicit Reference, shifts the attack from overt wording to contextual linkage. It decomposes a malicious objective into permissible objectives and links them through implicit references within the context. The workflow is two-stage: a rewritten prompt scatters sub-objectives into innocuous outline elements; the model generates an intermediate “article”; a cropped follow-up prompt then refers back implicitly to a section of that article and amplifies the concealed malicious content. The paper reports ASR exceeding $f_\theta:\mathcal{P}\to\mathcal{P}$5 on most models, including GPT-4o, Claude-3.5-Sonnet, and Qwen-2-72B, and describes an inverse scaling phenomenon in which larger models are more vulnerable because they leverage context more powerfully. It also introduces a cross-model attack strategy that uses a less secure model to generate the contextual history for a stronger target model (Wu et al., 2024).

TASTLE implements reframing through malicious-content concealing and memory-reframing with an iterative optimization algorithm. Concealing wraps a forbidden request inside a much longer, cognitively demanding main task; memory-reframing then appends an explicit instruction that forces the target LLM to “forget” the main task and jump directly to the auxiliary one, using the prefix “Sure! I am happy to do that! I will shift my focus to the AUXILIARY TASK, discarding the above scenario, personality, and original task.” The framework is black-box, uses a judgement model, and by default runs $f_\theta:\mathcal{P}\to\mathcal{P}$6 round, $f_\theta:\mathcal{P}\to\mathcal{P}$7 streams, $f_\theta:\mathcal{P}\to\mathcal{P}$8 iterations, with a total target-model query budget of approximately $f_\theta:\mathcal{P}\to\mathcal{P}$9. Reported Top-1 ASR values are $x_0$0 on GPT-3.5-0613 and $x_0$1 on GPT-4; ablations show that without malicious-content concealing, Top-1 ASR on LLaMA-2 drops from $x_0$2 to $x_0$3, and without memory-reframing, Top-1 ASR on ChatGPT drops from $x_0$4 to $x_0$5 (Xiao et al., 2024).

Taken together, these works show that attack reframing in LLMs is not limited to paraphrase. It may operate through semantic-band optimization, contextual decomposition, recency bias, forced-prefix continuation, or cross-model transfer.

4. Spatial and multimodal reframing

In unified multimodal models, STaR-Attack uses narrative reframing rather than prompt rewriting. The attack exploits Cross-Modal Generative Injection, defined on a unified multimodal model $x_0$6, where $x_0$7 is the image-generation function and $x_0$8 is the understanding function. The attacker selects a malicious query $x_0$9 and a corresponding hidden malicious event $x^*=f_\theta(x_0)$0 with high semantic relevance, then constructs a three-act narrative with a pre-event scene, the hidden climax, and a post-event scene. The paper models this as a directed causal graph

$x^*=f_\theta(x_0)$1

and uses two rounds of image generation followed by a guessing game in which the original malicious question is embedded among benign candidates. Reported results include up to $x^*=f_\theta(x_0)$2 ASR and $x^*=f_\theta(x_0)$3 RASR on Gemini-2.0-Flash for AdvBench, with dynamic difficulty yielding a $x^*=f_\theta(x_0)$4–$x^*=f_\theta(x_0)$5 percentage-point ASR improvement over fixed-level settings and the full multi-turn narrative pipeline boosting ASR by up to $x^*=f_\theta(x_0)$6 percentage points in some settings (Guo et al., 30 Sep 2025).

“Adversarial Framing” addresses a different layer of the system: the geometry of the input. Instead of modifying most pixels or using an occluding patch, it keeps the image unchanged and only adds an adversarial framing on the border of the image. The learned frame $x^*=f_\theta(x_0)$7 is universal, so the same $x^*=f_\theta(x_0)$8 is applied to every image or video, and test-time application requires no per-sample optimization. On ImageNet with ResNet-50, clean accuracy is $x^*=f_\theta(x_0)$9, while adversarial framing reduces it to $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$0 for width $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$1, $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$2 for $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$3, $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$4 for $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$5, and $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$6 for $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$7. On UCF101 with a ResNeXt-101 3D CNN, clean accuracy is $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$8, dropping to $S(x,y)=\mathrm{cosine}(\phi(x),\phi(y))$9, $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$0, $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$1, and $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$2 for $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$3, respectively. The paper also reports targeted attack success rates for $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$4: on ImageNet, minimum $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$5, average $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$6, maximum $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$7; on UCF101, minimum $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$8, average $R(x,y)=f_{\mathrm{safe}}(y)-f_{\mathrm{safe}}(x),$9, maximum $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$0. Grad-CAM visualizations reveal that after framing the network focuses heavily on the border (Zolna et al., 2018).

These two lines of work differ in modality and mechanism, but both relocate the adversarial payload away from the most obvious locus of inspection. In STaR-Attack the malicious event is inferred from narrative context rather than stated directly; in Adversarial Framing the perturbation is moved to the border while the image content remains unchanged.

5. Framing the detector in power-system state estimation

In power systems, a data framing attack is a man-in-the-middle state attack that exploits bad-data detection and identification mechanisms. Conventional false-data injection attacks seek an attack vector $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$1 such that the residual test does not raise an alarm. By contrast, a data framing attack deliberately triggers the bad-data detector, but in such a way that the control center frames a subset of normal meters as bad. Once the control center removes those framed meters, the remaining corrupted measurements admit a covert-style attack on the reduced system (Kim et al., 2013).

The underlying model is the standard locally linearized DC state-estimation model,

$$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$2

with weighted least squares estimator

$$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$3

Bad-data detection uses the residual

$$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$4

and declares bad data if $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$5. Identification proceeds through normalized residuals, removing the meter with largest $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$6 and repeating estimation (Kim et al., 2013).

The attack-design problem is formulated as a quadratically constrained quadratic program. The attacker chooses a set $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$7 of meters to frame and a set $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$8 of meters it controls, then maximizes the normalized residuals on $$\max_{\delta_i} R(x_{i-1},x_{i-1}+\delta_i) \quad \text{s.t.} \quad \epsilon_1<S(x_{i-1},x_{i-1}+\delta_i)<\epsilon_2.$$9 subject to support and feasibility constraints. With the parameterization $L=5$0, the objective becomes a constrained eigenvalue problem, and the optimal direction is given by the principal eigenvector of $L=5$1. The paper’s factor-of-two result states that, under mild tie-breaking conditions, controlling only half of a critical set and framing the other half suffices to unobservable-ify the reduced network, so that the estimated state can be perturbed by an arbitrary amount (Kim et al., 2013).

Simulation results on IEEE 14- and 118-bus systems evaluate $L=5$2 versus meter SNR and show that framing attacks yield residual bias growing with the attack magnitude, persisting even at very high SNR. The paper reports phase-angle errors up to several degrees, and concludes that legacy $L=5$3 plus largest-residual identification is insufficient because attackers can cause large misestimates with only partial meter access and cause mis-removal of good meters (Kim et al., 2013).

6. Formal semantics, misconceptions, and defensive implications

A formal account of attack relations appears in the intuitionistic-logic treatment of argumentation frameworks. There, an attack $L=5$4 is translated to $L=5$5, and the intuitionistic models of the resulting theory characterize complete extensions of the framework. The translation introduces four schemata for each $L=5$6, and the resulting models over Gödel’s three-valued intuitionistic propositional logic correspond one-to-one with Caminada labellings. Crucially, this framework allows higher level attacks, where an attack “$L=5$7” can itself attack another attack “$L=5$8,” and meta-statements $L=5$9 on $\epsilon_1=0.05$0 can attack and be attacked in the domain (Gabbay et al., 2015).

This logic paper does not study “reframing” in the operational sense used by jailbreak or disinformation work. However, it is relevant because it makes attack relations themselves first-class objects. A plausible implication is that reframing can be analyzed not only as input transformation but also as a meta-level transformation on what counts as the attacked object: an argument, an attack, a detector decision, or a causal narrative.

A common misconception is that attack reframing is equivalent to keyword rewriting. The supplied literature shows otherwise. In THREAT, the central mechanism is constrained optimization of safety gain under semantic-similarity bounds; in AIR, the model reconstructs the harmful objective from implicit reference; in TASTLE, recency bias and a forced prefix are used to shift generation focus; in STaR-Attack, the model infers the hidden climax from pre-event and post-event scenes; in Adversarial Framing, the perturbation is placed on the border; and in data framing attacks, the bad-data removal pipeline is manipulated to expunge correct measurements (Sakib et al., 20 May 2026, Wu et al., 2024, Xiao et al., 2024, Guo et al., 30 Sep 2025, Zolna et al., 2018, Kim et al., 2013).

The defensive implications are correspondingly heterogeneous. AIR recommends contextual-link detection, implicit-reference regularization, dynamic prompt sanitization, multi-turn refusal cohesion, and human-in-the-loop spot-checks. STaR-Attack proposes cross-modal consistency checks, multi-turn context gating, narrative anomaly detection, and limits on the dynamic difficulty mechanism. Adversarial Framing suggests random resizing or cropping, as well as random padding, random border jittering, or training with random border augmentations. The power-system paper points to robust estimation methods, randomized measurement sub-sampling or topology-hopping, and cross-checking with PMU-based direct angle measurements. TASTLE evaluates Self-Reminder, In-context Defense, and Perplexity Filter, reporting that Perplexity Filter fails entirely, while the other defenses reduce but do not eliminate ASR (Wu et al., 2024, Guo et al., 30 Sep 2025, Zolna et al., 2018, Kim et al., 2013, Xiao et al., 2024).

Across these domains, attack reframing is best understood as a strategic relocation of the adversarial burden. Instead of confronting the defended interface directly, the attacker changes the representational pathway through which the harmful objective is recovered: by audience appeal, contextual reconstruction, narrative inference, spatial periphery, or detector misattribution.