OTTER: A Red-Teaming System for Toxicity-Evading Jailbreak Prompt Optimization

• URL: http://arxiv.org/abs/2606.21077v1
• Date: Fri, 19 Jun 2026 03:55:08 GMT
• Title: OTTER: A Red-Teaming System for Toxicity-Evading Jailbreak Prompt Optimization
• Abstract summary: We show that surface toxicity and adversarial intent can be decoupled by replacing as few as five tokens.<n>We present OTTER, a black-box red-teaming framework requiring only standard API access.<n>We provide the first quantitative analysis of the toxicity--bypass relationship and a per-category breakdown.
• Score: 1.5140372490736642
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Production LLMs increasingly rely on toxicity-based moderation filters as a primary defense, assuming that harmful intent correlates with toxic surface wording. We show this assumption is fundamentally brittle: surface toxicity and adversarial intent can be decoupled by replacing as few as five tokens. We present OTTER (Obfuscated Toxicity-Evading Token Evolution for Rewriting), a black-box red-teaming framework requiring only standard API access, directly targeting the practical constraints of industry security audits. Evaluated on 457 AdvBench prompts across four GPT models, OTTER raises average ASR from 7.0% to 84.0%. We further provide the first quantitative analysis of the toxicity--bypass relationship and a per-category breakdown, translating our findings into actionable recommendations for classifier hardening in production deployments.

Related papers

• Discern Truth from Falsehood: Reducing Over-Refusal via Contrastive Refinement [14.1763272695827]
  Large language models (LLMs) aligned for safety often suffer from over-refusal.<n>This behavior undermines models' helpfulness and restricts usability in sensitive or nuanced contexts.<n>We argue that this issue arises from the ambiguous influence of toxic and seemingly toxic prompts on the model's learning dynamics.
  arXiv  Detail & Related papers  (2026-02-10T05:53:10Z)
• Unveiling Covert Toxicity in Multimodal Data via Toxicity Association Graphs: A Graph-Based Metric and Interpretable Detection Framework [58.01529356381494]
  We propose a novel detection framework based on Toxicity Association Graphs (TAGs)<n>We introduce the first quantifiable metric for hidden toxicity, the Multimodal Toxicity Covertness (MTC)<n>Our approach enables precise identification of covert toxicity while preserving full interpretability of the decision-making process.
  arXiv  Detail & Related papers  (2026-02-03T08:54:25Z)
• Projecting Out the Malice: A Global Subspace Approach to LLM Detoxification [73.77171973106567]
  Large language models (LLMs) exhibit exceptional performance but pose inherent risks of generating toxic content.<n>Traditional methods fail to eliminate underlying toxic regions in parameters, leaving models vulnerable to adversarial attacks.<n>We propose GLOSS, a lightweight method that mitigates toxicity by identifying and eliminating this global subspace from FFN parameters.
  arXiv  Detail & Related papers  (2026-01-09T09:34:53Z)
• Rethinking Toxicity Evaluation in Large Language Models: A Multi-Label Perspective [104.09817371557476]
  Large language models (LLMs) have achieved impressive results across a range of natural language processing tasks.<n>Their potential to generate harmful content has raised serious safety concerns.<n>We introduce three novel multi-label benchmarks for toxicity detection.
  arXiv  Detail & Related papers  (2025-10-16T06:50:33Z)
• Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editing [77.75609817898035]
  Large Language Models (LLMs) have demonstrated impressive performance across various tasks, yet they remain vulnerable to generating toxic content.<n>We propose textscAutoregressive textscReward textscGuided textscRe presentation textscEditing (ARGRE)<n>ARGRE explicitly models toxicity transitions within the latent representation space, enabling stable and precise reward-guided editing.
  arXiv  Detail & Related papers  (2025-09-24T03:40:32Z)
• Adaptive Detoxification: Safeguarding General Capabilities of LLMs through Toxicity-Aware Knowledge Editing [49.85884082568318]
  ToxEdit is a toxicity-aware knowledge editing approach.<n>It dynamically detects toxic activation patterns during forward propagation.<n>It then routes computations through adaptive inter-layer pathways to mitigate toxicity effectively.
  arXiv  Detail & Related papers  (2025-05-28T12:37:06Z)
• RedDiffuser: Red Teaming Vision-Language Models for Toxic Continuation via Reinforced Stable Diffusion [27.68654681867373]
  Vision-Language Models (VLMs) are vulnerable to jailbreak attacks.<n>In this work, we examine an insidious variant of this threat: toxic continuation.<n>We propose RedDiffuser, which generates natural-looking adversarial images that induce toxic continuations.
  arXiv  Detail & Related papers  (2025-03-08T13:51:40Z)
• How Toxic Can You Get? Search-based Toxicity Testing for Large Language Models [2.058058560925183]
  Large Language Models (LLMs) can cause extensive harm when prone to generating toxic responses.<n>We present EvoTox, an automated testing framework for LLMs' inclination to toxicity.<n>We conduct a quantitative and qualitative empirical evaluation using five state-of-the-art LLMs.
  arXiv  Detail & Related papers  (2025-01-03T10:08:49Z)
• Unveiling the Implicit Toxicity in Large Language Models [77.90933074675543]
  The open-endedness of large language models (LLMs) combined with their impressive capabilities may lead to new safety issues when being exploited for malicious use. We show that LLMs can generate diverse implicit toxic outputs that are exceptionally difficult to detect via simply zero-shot prompting. We propose a reinforcement learning (RL) based attacking method to further induce the implicit toxicity in LLMs.
  arXiv  Detail & Related papers  (2023-11-29T06:42:36Z)
• ToxiSpanSE: An Explainable Toxicity Detection in Code Review Comments [4.949881799107062]
  ToxiSpanSE is the first tool to detect toxic spans in the Software Engineering (SE) domain. Our model achieved the best score with 0.88 $F1$, 0.87 precision, and 0.93 recall for toxic class tokens.
  arXiv  Detail & Related papers  (2023-07-07T04:55:11Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.