While Large Language Models (LLMs) have powerful capabilities, they remain vulnerable to jailbreak attacks, which is a critical barrier to their safe web real-time application. Current commercial LLM providers deploy output guardrails to filter harmful outputs, yet these defenses are not impenetrable. Due to LLMs' reliance on autoregressive, token-by-token inference, their semantic representations lack robustness to spatially structured perturbations, such as redistributing tokens across different rows, columns, or diagonals. Exploiting the Transformer's spatial weakness, we propose SpatialJB to disrupt the model's output generation process, allowing harmful content to bypass guardrails without detection. Comprehensive experiments conducted on leading LLMs get nearly 100% ASR, demonstrating the high effectiveness of SpatialJB. Even after adding advanced output guardrails, like the OpenAI Moderation API, SpatialJB consistently maintains a success rate exceeding 75%, outperforming current jailbreak techniques by a significant margin. The proposal of SpatialJB exposes a key weakness in current guardrails and emphasizes the importance of spatial semantics, offering new insights to advance LLM safety research. To prevent potential misuse, we also present baseline defense strategies against SpatialJB and evaluate their effectiveness in mitigating such attacks. The code for the attack, baseline defenses, and a demo are available at https://anonymous.4open.science/r/SpatialJailbreak-8E63.

翻译：尽管大型语言模型（LLM）具备强大的能力，它们仍然容易受到越狱攻击，这是其安全实时网络应用的关键障碍。当前商业LLM提供商部署输出护栏以过滤有害输出，但这些防御并非无懈可击。由于LLM依赖于自回归的逐令牌推理，其语义表示对空间结构化扰动（例如在不同行、列或对角线上重新分布令牌）缺乏鲁棒性。利用Transformer的空间弱点，我们提出SpatialJB来干扰模型的输出生成过程，使有害内容能够绕过护栏而不被检测。在主流LLM上进行的全面实验获得了接近100%的攻击成功率（ASR），证明了SpatialJB的高效性。即使在添加了如OpenAI Moderation API等高级输出护栏后，SpatialJB仍能持续保持超过75%的成功率，显著优于现有越狱技术。SpatialJB的提出揭示了当前护栏的一个关键弱点，并强调了空间语义的重要性，为推进LLM安全研究提供了新见解。为防止潜在滥用，我们还提出了针对SpatialJB的基线防御策略，并评估了其在缓解此类攻击方面的有效性。攻击代码、基线防御及演示可在https://anonymous.4open.science/r/SpatialJailbreak-8E63获取。