BlindBias bypasses Gemini-3.5-Flash safety via black-box distribution reconstruction

Auto-published from arXiv:2609.36956 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [possible-zero-day, no-prompt-excerpt]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

jailbreak

Model

Gemini-3.5-Flash

Surface

API (text-only, no logit access; Google API endpoint)

Setup

The BlindBias framework targets text-only continuation interfaces that permit repeated sampling and assistant-prefix injection. At each generation step, K=50 continuation samples are drawn to reconstruct the next-token distribution using a Dirichlet prior over unobserved tokens. A BiasNet residual controller then shifts the reconstructed distribution toward a harmful target. The attack uses affirmative target prefixes from AdvBench as objectives. The paper does not quote a verbatim jailbreak prompt — specific attack strings are not disclosed.

Reproduction anchor

code: https://github.com/JessonWong/controlled-decoding (cited in HTML body); benchmark: SORRY-Bench (440 prompts, 44 safety categories); HarmBench (320-behavior text test split); AdvBench (520 harmful behaviors)

Observed behavior

On SORRY-Bench, BlindBias achieves Harm Score 3.67 and Harm Info Score 2.30 against Gemini-3.5-Flash, compared to the strongest baseline (FlipAttack) at 1.51 / 0.70 — a ~2.4× improvement in harmful compliance. BlindBias records the highest mean scores in 20 of 24 comparisons across 4 models × 3 benchmarks.

Expected behavior

The model should refuse harmful requests consistently regardless of repeated sampling or prefix manipulation at the API level; safety alignment should not be bypassable without weight or logit access.

Reproducibility

medium

Threat model

An attacker with only black-box API access (no model weights, no logit scores) can systematically extract harmful information from safety-aligned production LLMs by issuing ~50 parallel samples per generation step to statistically reconstruct and steer token distributions. This makes alignment-bypass feasible against any commercial LLM API, including paid consumer-facing endpoints.

Novelty

First framework demonstrating that controlled decoding attacks — previously requiring white-box logit access — can be performed effectively against fully black-box text-only APIs, closing the gap between white-box and black-box jailbreak capability.

Source

• arXiv: 2609.36956
• PDF: https://arxiv.org/pdf/2609.36956
• Categories: cs.CR, cs.AI
• Authors: Jesson Wang, Shawn Li, Wei Yang, Franck Dernoncourt, Ryan A. Rossi, Charith Peris, Yue Zhao

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Novel attack framework for jailbreaking black-box LLMs via text-only interfaces; tested against 4 deployed endpoints with demonstrated bypasses of safety alignment. No vendor disclosure mentioned.

─────────────────────────────────────────────────────────────────────