<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="peng-etal-2026-state2state">
    <titleInfo>
        <title>State2State: Revealing Compositional Safety Failures through State-Transition Reasoning</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Chu-Jun</namePart>
        <namePart type="family">Peng</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Zhong-Wei</namePart>
        <namePart type="family">Lin</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yu-Wen</namePart>
        <namePart type="family">Tseng</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Hong-Han</namePart>
        <namePart type="family">Shuai</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Wen-Huang</namePart>
        <namePart type="family">Cheng</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Current aligned models can reject explicit harmful requests, yet may remain vulnerable when harmful intent is distributed across semantically related descriptions. Existing jailbreak methods often rely on surface-form manipulation, decomposition, or visual obfuscation, but the harmful objective may still remain detectable by modern safety safeguards. We present State2State (S2S), a state-transition-based, single-turn black-box jailbreak framework that targets a core weakness of current aligned models: compositional blindness. S2S rewrites a harmful request into a pair of original-state and final-state descriptions, then prompts the target model to explain the causal transition between them. Instead of directly processing an explicit harmful instruction, the model infers the malicious procedure as the logical bridge connecting the initial and final states. Controlled ablations further show that S2S remains highly effective when the state descriptions are provided as text only, while rendering them as visual inputs does not improve attack success. This suggests that the observed vulnerability is not driven solely by visual obfuscation, but is associated with compositional reasoning over transformation semantics. Across seven recent target models, S2S achieves 81.33% ASR on OpenAI o1, outperforming strong baselines by 74.63 to 81.33 percentage points and exposing a critical blind spot in current model safety safeguards.</abstract>
    <identifier type="citekey">peng-etal-2026-state2state</identifier>
    <identifier type="doi">10.18653/2026.findings-emnlp.2379</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.2379/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>51106</start>
            <end>51121</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T State2State: Revealing Compositional Safety Failures through State-Transition Reasoning
%A Peng, Chu-Jun
%A Lin, Zhong-Wei
%A Tseng, Yu-Wen
%A Shuai, Hong-Han
%A Cheng, Wen-Huang
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F peng-etal-2026-state2state
%X Current aligned models can reject explicit harmful requests, yet may remain vulnerable when harmful intent is distributed across semantically related descriptions. Existing jailbreak methods often rely on surface-form manipulation, decomposition, or visual obfuscation, but the harmful objective may still remain detectable by modern safety safeguards. We present State2State (S2S), a state-transition-based, single-turn black-box jailbreak framework that targets a core weakness of current aligned models: compositional blindness. S2S rewrites a harmful request into a pair of original-state and final-state descriptions, then prompts the target model to explain the causal transition between them. Instead of directly processing an explicit harmful instruction, the model infers the malicious procedure as the logical bridge connecting the initial and final states. Controlled ablations further show that S2S remains highly effective when the state descriptions are provided as text only, while rendering them as visual inputs does not improve attack success. This suggests that the observed vulnerability is not driven solely by visual obfuscation, but is associated with compositional reasoning over transformation semantics. Across seven recent target models, S2S achieves 81.33% ASR on OpenAI o1, outperforming strong baselines by 74.63 to 81.33 percentage points and exposing a critical blind spot in current model safety safeguards.
%R 10.18653/2026.findings-emnlp.2379
%U https://aclanthology.org/2026.findings-emnlp.2379/
%U https://doi.org/10.18653/2026.findings-emnlp.2379
%P 51106-51121

Markdown (Informal)

[State2State: Revealing Compositional Safety Failures through State-Transition Reasoning](https://aclanthology.org/2026.findings-emnlp.2379/) (Peng et al., Findings 2026)

• State2State: Revealing Compositional Safety Failures through State-Transition Reasoning (Peng et al., Findings 2026)

ACL

• Chu-Jun Peng, Zhong-Wei Lin, Yu-Wen Tseng, Hong-Han Shuai, and Wen-Huang Cheng. 2026. State2State: Revealing Compositional Safety Failures through State-Transition Reasoning. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 51106–51121, Budapest, Hungary. Association for Computational Linguistics.