@inproceedings{yan-etal-2025-benign,
    title = "from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphors",
    author = "Yan, Yu  and
      Sun, Sheng  and
      Duan, Zenghao  and
      Liu, Teli  and
      Liu, Min  and
      Yin, Zhiyi  and
      LeiJingyu, LeiJingyu  and
      Li, Qi",
    editor = "Che, Wanxiang  and
      Nabende, Joyce  and
      Shutova, Ekaterina  and
      Pilehvar, Mohammad Taher",
    booktitle = "Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2025",
    address = "Vienna, Austria",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingestion-acl-25/2025.acl-long.238/",
    pages = "4785--4817",
    ISBN = "979-8-89176-251-0",
    abstract = "Current studies have exposed the risk of Large Language Models (LLMs) generating harmful content by jailbreak attacks. However, they overlook that the direct generation of harmful content from scratch is more difficult than inducing LLM to calibrate benign content into harmful forms.In our study, we introduce a novel attack framework that exploits \textbf{A}d\textbf{V}ers\textbf{A}rial me\textbf{TA}pho\textbf{R} (\textbf{AVATAR}) to induce the LLM to calibrate malicious metaphors for jailbreaking.Specifically, to answer harmful queries, AVATAR adaptively identifies a set of benign but logically related metaphors as the initial seed.Then, driven by these metaphors, the target LLM is induced to reason and calibrate about the metaphorical content, thus jailbroken by either directly outputting harmful responses or calibrating residuals between metaphorical and professional harmful content.Experimental results demonstrate that AVATAR can effectively and transferably jailbreak LLMs and achieve a state-of-the-art attack success rate across multiple advanced LLMs."
}