No fine-tuning required: frontier models pick up cipher-based jailbreaks from prompting alone.

Safety teams try to stop jailbreaks, which trick artificial intelligence into giving harmful answers. One way attackers do this is through arbitrary ciphers, or secret codes. In past tests, attackers had to fine-tune models, meaning they retrained them on encrypted harmful data so the AI would answer in code. The researchers tested newer frontier models to see if they could skip this retraining. They found that these systems do not need fine-tuningfine-tuningAdditional training on a specific dataset to adapt a model for a particular task.. Instead, models learn the ciphercipherA secret code that transforms readable text into something that looks like gibberish to anyone who doesn't know the code. just from regular prompts and in-context learningin-context learningThe ability of a model to learn a new task from examples given in the prompt, without changing its weights., which means learning from examples in the conversation. When chatting in cipher, safety rules weaken or fail completely. Encrypted harmful requests look like gibberish, allowing the attack to slip past commercial safety filters.

Why it matters

This matters because it shows that even without access to a model's training process, anyone can jailbreak it by simply prompting it to use a cipher. That means current safety measures, which rely on detecting harmful content, can be bypassed because the harmful content is hidden in gibberish. Companies like Anthropic, Google, and OpenAI are directly affected, and their existing defenses may be insufficient.

Questions answered