SpatialJB: How Text Distribution Art Becomes The "Jailbreak Key" for LLM Guardrails

While Large Language Models (LLMs) have achieved remarkable success across diverse tasks, they remain vulnerable to jailbreak attacks, which pose significant risks to their secure deployment. Driven by their inherent token-by-token autoregressive inference, LLMs exhibit semantic representations that lack robustness against spatially structured perturbations, thereby rendering current output-guardrail safety mechanisms penetrable. Exploiting the Transformer's spatial weakness, we propose SpatialJB to disrupt the model’s output generation process, allowing harmful content to bypass guardrails without detection. Comprehensive experiments on leading LLMs demonstrate that SpatialJB achieves a nearly 100\% ASR and consistently maintains a success rate exceeding 75\% even against advanced output guardrails like the OpenAI Moderation API, outperforming current jailbreak techniques by a significant margin. While SpatialJB advances LLM safety research by exposing guardrail weaknesses and highlighting spatial semantics, we also propose and evaluate baseline defense strategies to prevent its potential misuse. You can click Video Link and Code Link to see our demo presentation and code.

Large language models (LLMs) are increasingly used in everyday applications, making safety protections essential. Current AI systems rely on guardrails to block harmful responses, but attackers continue finding ways to bypass them. Existing protections mainly analyze text as a sequence of words, creating an overlooked weakness when text is arranged in unusual visual layouts. We develop SpatialJB, a method that reorganizes text into spatial patterns while keeping it understandable to humans. We find that language models often struggle to recognize harmful meaning when text is distributed across layouts such as multi-line structures, allowing harmful content to evade existing safety protections. Our findings reveal an important limitation in current AI safety systems and highlight the need for future defenses that understand not only what text says, but also how text is visually organized. We also explore basic defense strategies to help improve the safety of deployed AI systems.