SpatialJB: How Text Distribution Art Becomes The "Jailbreak Key" for LLM Guardrails

摘要

While Large Language Models (LLMs) have achieved remarkable success across diverse tasks, they remain vulnerable to jailbreak attacks, which pose significant risks to their secure deployment. Driven by their inherent token-by-token autoregressive inference, LLMs exhibit semantic representations that lack robustness against spatially structured perturbations, thereby rendering current output-guardrail safety mechanisms penetrable. Exploiting the Transformer's spatial weakness, we propose SpatialJB to disrupt the model’s output generation process, allowing harmful content to bypass guardrails without detection. Comprehensive experiments on leading LLMs demonstrate that SpatialJB achieves a nearly 100\% ASR and consistently maintains a success rate exceeding 75\% even against advanced output guardrails like the OpenAI Moderation API, outperforming current jailbreak techniques by a significant margin. While **SpatialJB** advances LLM safety research by exposing guardrail weaknesses and highlighting spatial semantics, we also propose and evaluate baseline defense strategies to prevent its potential misuse. You can click [Video Link](https://1drv.ms/v/s!ApaP6YaJA87pgk-Rk7ZCvPeYcIZa?e=J8kbg0) and [Code Link](https://github.com/DongFangShenWa/SpatialJailbreak.git) to see our demo presentation and code.