In-Context Representation Hijacking
We introduce Doublespeak, a simple in-context representation hijacking attack against large language models (LLMs). The attack works by systematically replacing a harmful keyword (e.g., bomb) with a benign token (e.g., carrot) across multiple in-context examples, provided a prefix to a harmful request. We demonstrate that this substitution leads to the internal representation of the benign token converging toward that of the harmful one, effectively embedding the harmful semantics under a euphemism. As a result, superficially innocuous prompts (e.g., ``How to build a carrot?'') are internally interpreted as disallowed instructions (e.g., ``How to build a bomb?''), thereby bypassing the model's safety alignment. We use interpretability tools to show that this semantic overwrite emerges layer by layer, with benign meanings in early layers converging into harmful semantics in later ones. Doublespeak is optimization-free, broadly transferable across model families, and achieves strong success rates on closed-source and open-source systems, reaching 74\% ASR on Llama-3.3-70B-Instruct with a single-sentence context override. Our findings highlight a new attack surface in the latent space of LLMs, revealing that current alignment strategies are insufficient and should instead operate at the representation level.
69312ad72d1e5b0a7d84da54
Itay Yona
admin_assigned
2025-12-04T11:14:30.502Z
62697edaa6a7bba9e46ae4ad
/avatars/3009bf769a09d946447a0e8c833a04f3.svg
Itay Yona
tux
user
tux
69312ad72d1e5b0a7d84da55
Amir Sarid
admin_assigned
2025-12-04T11:14:24.636Z
6303edf5eedc089484c69468
/avatars/698f872020bbe9477eab7a597fc75d4f.svg
Amir Sarid
aimir
user
aimir
69312ad72d1e5b0a7d84da56
Michael Karasik
admin_assigned
2025-12-04T11:14:19.281Z
684c13ec2bab8cb9a16919b5
/avatars/feb0f19205d87a2355d6d0c0d50b9c75.svg
Michael Karasik
MichaelKar
user
MichaelKar
69312ad72d1e5b0a7d84da57
Yossi Gandelsman
admin_assigned
2025-12-04T11:14:13.725Z
62f6942205ca68c0e0ff7b97
/avatars/b0600de531b4c88f4aa7c30c5ceb06e1.svg
Yossi Gandelsman
yossig
user
yossig
In-Context Representation Hijacking
We introduce Doublespeak, a simple in-context representation hijacking attack against large language models (LLMs). The attack works by systematically replacing a harmful keyword (e.g., bomb) with a benign token (e.g., carrot) across multiple in-context examples, provided a prefix to a harmful request. We demonstrate that this substitution leads to the internal representation of the benign token converging toward that of the harmful one, effectively embedding the harmful semantics under a euphemism. As a result, superficially innocuous prompts (e.g., ``How to build a carrot?'') are internally interpreted as disallowed instructions (e.g., ``How to build a bomb?''), thereby bypassing the model's safety alignment. We use interpretability tools to show that this semantic overwrite emerges layer by layer, with benign meanings in early layers converging into harmful semantics in later ones. Doublespeak is optimization-free, broadly transferable across model families, and achieves strong success rates on closed-source and open-source systems, reaching 74\% ASR on Llama-3.3-70B-Instruct with a single-sentence context override. Our findings highlight a new attack surface in the latent space of LLMs, revealing that current alignment strategies are insufficient and should instead operate at the representation level.
The attack Doublespeak manipulates the internal representation of benign tokens to align with harmful semantics, bypassing safety measures in large language models.
in-context representation hijacking large language models LLMs harmful keyword benign token internal representation euphemism semantic overwrite interpretability tools latent space safety alignment