Jailbreaking Large Language Models with Symbolic Mathematics

Mathematical encoding creates a significant safety blind spot: The research demonstrates that rephrasing harmful requests as mathematical problems successfully bypasses safety measures in 73.6% of cases across leading LLMs, suggesting current safety training focuses too narrowly on natural language patterns and misses alternative input formats.

Safety mechanisms don't generalize across different problem types: The paper reveals that LLMs trained to refuse harmful requests in standard language fail to recognize the same harmful intent when presented mathematically, indicating that safety training needs to account for semantic equivalence across diverse input modalities, not just variations within natural language.

The semantic shift explains why models are fooled: Analysis shows that encoding harmful prompts mathematically creates substantial changes in how the AI's internal representations (embedding vectors) process the information, effectively disguising the harmful intent from safety filters that were trained on different input patterns.

Red-teaming efforts remain incomplete: By identifying this vulnerability, the research underscores that comprehensive AI safety requires adversarial testing across all potential input types—not just natural language variations—to uncover gaps in current safeguards before systems are deployed.

Holistic safety approaches are essential: The findings argue against relying on single safety mechanisms and instead advocate for multi-layered defenses that consider how LLMs might process harmful requests through different domains (mathematical, code-based, etc.) to achieve more robust protection.