Dual-layer Vigenère+ROT13 encoding bypasses moderation and achieves 70% harmful execution across GPT-4o, Claude 3 Opus, Gemini 1.5 Pro

Auto-published from arXiv:2607.27373 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.77, flags: [possible-zero-day, no-prompt-excerpt]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

jailbreak

Model

GPT-4o (gpt-4o-2024-11-20), Claude 3 Opus (claude-3-opus-20240229), Gemini 1.5 Pro (gemini-1.5-pro-002)

Surface

API / chat UI (black-box access only)

Setup

The RoguePrompt pipeline splits a forbidden prompt into even- and odd-indexed character streams, Vigenère-encrypts the odd stream with a fixed key, assembles a length-prefixed serialized payload (len(u₀):u₀|len(u₁):u₁), applies ROT13 to the assembled payload, then wraps it in natural-language instructions directing the model to reverse ROT13, parse the field structure, decrypt the odd stream with the provided Vigenère key, recombine even+odd streams, and execute the reconstructed request — all in a single response. The paper does not reproduce the exact wrapper text in reviewable artifacts; the serialization grammar is EVEN = s(E); ODD = O′; KEY = φ; ORDER = 0-even. Evaluated on 313 StrongREJECT hard-rejected prompts, 3 trials each.

Observed behavior

Average across all three models: 93.93% of encoded payloads passed input moderation (bypass@3), 79.02% were correctly decoded by the model and the original forbidden request was recovered in the output (reconstruction@3), and 70.18% resulted in substantive execution of the forbidden request (execution@3). Per-model execution rates: Claude 3 Opus 73.16%, GPT-4o 71.25%, Gemini 1.5 Pro 66.13%.

Expected behavior

The model should refuse the underlying harmful request regardless of encoding. Input moderation should detect the obfuscated intent, or the model should decline to follow decryption-and-execute instructions when the reconstructed content is policy-violating.

Reproducibility

medium

Threat model

An adversary with only API or UI access (no model weights) can automate the encoding pipeline against any of these production models to extract harmful content (e.g., instructions for weapons, illicit activity) that direct prompting would reject. The 70%+ execution rate makes this a viable at-scale attack against consumer-facing and enterprise-facing LLM deployments.

Novelty

First paper to decompose a multi-stage cipher jailbreak into distinct measurable stages (bypass, reconstruction, execution), providing stage-level evidence of where the attack succeeds and fails rather than collapsing everything into a single aggregate success rate.

Source

• arXiv: 2607.27373
• PDF: https://arxiv.org/pdf/2607.27373
• Categories: cs.CR, cs.AI
• Authors: Benyamin Tafreshian, Prathamesh Dhake

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: Novel dual-layer encoding jailbreak demonstrates concrete, reproducible filter bypass against production LLMs with stage-level measurements (93.93% bypass, 79.02% reconstruction, 70.18% execution on 313 real prompts). No vendor disclosure mentioned in abstract.

─────────────────────────────────────────────────────────────────────