Reprogramming LLM Semantics: a Symbolic Attack using Words Reframing

Disclaimer: The data contains potentially offensive and harmful text. This capsule contains files for the "Reprogramming LLM Semantics: a Symbolic Attack using Words Reframing" paper: * llamator-EG-attack.ipynb - LLM Security Pipeline with custom attack running * asr.ipynb - Notebook for ASR counting Large language models (LLMs) are widely used because they are simple and powerful, yet safe deployment remains difficult. Though post-generation moderation and alignment have improved, adversarial prompting is still a major weakness: many defenses detect only surface patterns and ignore deeper semantic structure. We present a black-box jailbreak that exploits semantic reframing. Without accessing weights, logits, or internal prompts, we add a symbolic abstraction layer that keeps unsafe words’ surface form but redefines their meaning as abstract entities within the dialogue. This subtle reinterpretation lets LLMs process and generate content consistent with the new semantics, bypassing refusals. We evaluated the method on several leading models from different vendors using automated red-team tools on a subset of HarmBench across multiple harm categories. The attack achieves over 90% refusal-attack success and up to 78% ASR under the benchmark protocol, exposing a previously overlooked vulnerability tied to semantic reinterpretation. Our analysis also highlights factors that affect model resistance, offering insights for strengthening alignment against misuse such as disinformation or inappropriate content.