<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="he-etal-2026-cage">
    <titleInfo>
        <title>CAGE: Concept Algebra for Guardrail Evasion and Jailbreak Attacks via Lexical-Semantic Decoupling</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Zekai</namePart>
        <namePart type="family">He</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yuxiang</namePart>
        <namePart type="family">Chen</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jun</namePart>
        <namePart type="family">Shao</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xiao</namePart>
        <namePart type="family">Song</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Haibo</namePart>
        <namePart type="family">Hong</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Modern Large Language Models (LLMs) depend heavily on surface-level lexical filters for safety alignment, exposing a critical lexical-semantic gap: harmful intent can be fully decoupled from explicit wording. Motivated by this vulnerability, we propose CAGE (Concept Algebra for Guardrail Evasion), a single-turn black-box jailbreak leveraging the victim’s reasoning to reconstruct masked harmful intent. Through slot masking and concept equations, CAGE eliminates explicit triggers while guiding the target model to internally deduce the payload. Because standard evaluations conflate generic harmfulness with precise intent execution, we introduce the Strict Attack Success Rate (sASR), a metric that mandates verbatim slot recovery to measure reconstructive controllability beyond mere compliance. Across seven frontier models and three benchmarks, CAGE achieves an average ASR of 93.7% and sASR of 85.1%. Defense stress tests and keyword-recovery analysis reveal that existing token-level guardrails remain largely ineffective against reasoning-driven semantic evasion, suggesting that robust alignment must go beyond surface token filtering to address threats at the reasoning level.\par WARNING: THIS PAPER CONTAINS UNSAFE CONTENTS.</abstract>
    <identifier type="citekey">he-etal-2026-cage</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.216/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>4506</start>
            <end>4532</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T CAGE: Concept Algebra for Guardrail Evasion and Jailbreak Attacks via Lexical-Semantic Decoupling
%A He, Zekai
%A Chen, Yuxiang
%A Shao, Jun
%A Song, Xiao
%A Hong, Haibo
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F he-etal-2026-cage
%X Modern Large Language Models (LLMs) depend heavily on surface-level lexical filters for safety alignment, exposing a critical lexical-semantic gap: harmful intent can be fully decoupled from explicit wording. Motivated by this vulnerability, we propose CAGE (Concept Algebra for Guardrail Evasion), a single-turn black-box jailbreak leveraging the victim’s reasoning to reconstruct masked harmful intent. Through slot masking and concept equations, CAGE eliminates explicit triggers while guiding the target model to internally deduce the payload. Because standard evaluations conflate generic harmfulness with precise intent execution, we introduce the Strict Attack Success Rate (sASR), a metric that mandates verbatim slot recovery to measure reconstructive controllability beyond mere compliance. Across seven frontier models and three benchmarks, CAGE achieves an average ASR of 93.7% and sASR of 85.1%. Defense stress tests and keyword-recovery analysis reveal that existing token-level guardrails remain largely ineffective against reasoning-driven semantic evasion, suggesting that robust alignment must go beyond surface token filtering to address threats at the reasoning level.\par WARNING: THIS PAPER CONTAINS UNSAFE CONTENTS.
%U https://aclanthology.org/2026.findings-emnlp.216/
%P 4506-4532

Markdown (Informal)

[CAGE: Concept Algebra for Guardrail Evasion and Jailbreak Attacks via Lexical-Semantic Decoupling](https://aclanthology.org/2026.findings-emnlp.216/) (He et al., Findings 2026)

• CAGE: Concept Algebra for Guardrail Evasion and Jailbreak Attacks via Lexical-Semantic Decoupling (He et al., Findings 2026)

ACL

• Zekai He, Yuxiang Chen, Jun Shao, Xiao Song, and Haibo Hong. 2026. CAGE: Concept Algebra for Guardrail Evasion and Jailbreak Attacks via Lexical-Semantic Decoupling. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 4506–4532, Budapest, Hungary. Association for Computational Linguistics.