Search papers, labs, and topics across Lattice.
The paper introduces BAIT, a novel jailbreak framework that leverages self-conditioned reasoning to elicit harmful content from LLMs. BAIT iteratively guides the model to disclose sensitive information by first identifying and then refining the protection boundary before requesting a detailed example. Experiments across multiple benchmarks show that BAIT significantly outperforms existing jailbreak methods in terms of attack success rate.
LLMs can be tricked into revealing harmful content by iteratively refining their own understanding of safety boundaries, turning their consistency into a vulnerability.
In this work, we propose BAIT (Boundary-Aware Iterative Trap), a three-step jailbreak framework that approaches malicious goals through internal disclosure. BAIT first asks the model to identify the protection boundary, then requires it to refine that boundary, and finally requests a detailed example. By expanding each step upon the model's previous responses, BAIT turns the model's own reasoning and consistency tendency into a disclosure pathway. Experiments on AdvBench, JailbreakBench, AIR-Bench, and SORRY-Bench demonstrate that BAIT consistently achieves strong attack success rates across top-tier large language models, significantly advancing conventional jailbreak baselines. Further analysis reveals that: 1) prevention-oriented framing significantly outperforms direct knowledge request; 2) the refinement step plays a critical role in disclosure escalation; and 3) the first two steps have a certain chance of eliciting harmful content while triggering little filtering.
