Skip to content
Log in
Open access

You Are an Expert: RAG Injection and Guided Error Expert Activation for Jailbreaking Large Language Models

Shun Zhang Ying Ding Yanxu Mao
Aug 2026 · Expert systems · Vol 43 · 0 citations · 25 references

TL;DR

This work proposes a novel jailbreak framework: YAE, which enhances the model's dependency on external information by constructing a RAG‐based knowledge base containing harmful Q&A content and leverages Guide MoE, a routing‐inspired prompting strategy, to guide the model toward alternative reasoning trajectories through expert‐role prompting and domain‐specific perturbations.

Abstract

With the rapid development and widespread deployment of large language models (LLMs), the security and robustness of these models have emerged as critical research topics. Among various threats, jailbreak attacks, which aim to circumvent built‐in safety mechanisms, have garnered considerable attention as a key means of breaching model protections. However, existing jailbreak methods still face several limitations, such as excessive reliance on the model's internal capabilities, high attack costs and insufficiently comprehensive evaluation strategies. To address these challenges, we propose a novel jailbreak framework: YAE. This method enhances the model's dependency on external information by constructing a RAG‐based knowledge base containing harmful Q&A content. It also leverages Guide MoE, a routing‐inspired prompting strategy, to guide the model toward alternative reasoning trajectories through expert‐role prompting and domain‐specific perturbations, thereby inducing more deceptive responses. Furthermore, Adversarial Fine‐Tuning is employed to further optimize the performance of jailbreak attacks. We conduct extensive experiments under various settings, and the results demonstrate that YAE achieves state‐of‐the‐art performance in terms of both attack success rate (ASR) and efficiency, highlighting its strong overall effectiveness.

DOI Semantic Scholar
Read PDF

Similar papers

Review Open access 2026

DeepSeek Under Attack: An Analysis of Jailbreak Attacks and Prompt-Level Defenses

The reasoning model DeepSeek-R1 was more susceptible to jailbreak attacks than the non-reasoning model DeepSeek-V3, and different prompt-level defenses were effective against static jailbreaks.

V. T. Hayashi, Milton Pedro Pagliuso Neto, C. Miers et al. · 0 citations

Explaining Jailbreaks: Structured and Interpretable Safety Assessment for Large Language Models

This work proposes an explanation-aware safety framework that augments binary harmfulness detection with structured, human-interpretable explanations capturing severity, strategies, trigger spans, ratio-nales, and derived safety factors, and introduces a human–LLM hybrid annotation and canonicaliza-tion pipeline.

Sunghee Dong, Sungwon Yi, Kangmin Bae et al. · 0 citations
Preprint Aug 2026

Generating Attacks for LLMs with GFlowNets

This study proposes an automated, human-independent, and adaptive approach leveraging GFlowNets to identify LLM vulnerabilities by utilizing one large language model to test another, and introduces a model capable of generating attack inputs in the Turkish language.

Berkay Ozcam, Irem Onen, M. Amasyalı et al. · 0 citations
Preprint Jul 2026

The Effect of Multi-Lingual and Keyword Adversarial Injection on LLM Relevance Judgment

This work investigates the impact of cross-lingual prompt injection attacks on LLM-based relevance judgments using TREC Deep Learning collections and two open-weight models under established prompting frameworks, and demonstrates that multilingual query-based injections are highly effective in inflating relevance scores while simultaneously evading existing prompt-injection defenses.

Nguyen-Thanh-Thao Vo, Duy Duong Tuong, Oleg Zendel et al. · 0 citations
Conference Jul 2026

Generating Attacks for LLM with GFlowNets

The rapid advancement of Large Language Models (LLMs) has facilitated their ubiquitous integration into various domains, leading to widespread adoption. However, this escalating trend has introduced significant security vulnerabilities, necessitating the identification and mitigation of flaws arising from malicious exploitation. Red teaming assessments, conducted to evaluate model robustness through diverse adversarial inputs, are essential for exposing security risks and implementing countermeasures. Currently, red teaming is performed either manually by experts or automatically using predefined attack datasets. Nevertheless, manual testing remains time-consuming, while existing automated methods suffer from limited creativity due to their inherent dependency on fixed datasets. In this study, we propose an automated, human-independent, and adaptive approach leveraging GFlowNets to identify LLM vulnerabilities by utilizing one large language model to test another. Within this framework, an attacker model is trained against a specified victim model to perform automated red teaming and provide a quantitative robustness score. This research aims to generate more effective adversarial attacks in English compared to existing benchmarks and, as a novel contribution to the literature, introduces a model capable of generating attack inputs in the Turkish language.

Berkay Özçam, İrem Önen, E. I. Tatli et al. · 0 citations