Modern Large Language Models (LLMs) depend heavily on surface-level lexical filters for safety alignment, exposing a critical lexical-semantic gap: harmful intent can be fully decoupled from explicit wording. Motivated by this vulnerability, we propose CAGE (Concept Algebra for Guardrail Evasion), a single-turn black-box jailbreak leveraging the victim’s reasoning to reconstruct masked harmful intent. Through slot masking and concept equations, CAGE eliminates explicit triggers while guiding the target model to internally deduce the payload. Because standard evaluations conflate generic harmfulness with precise intent execution, we introduce the Strict Attack Success Rate (sASR), a metric that mandates verbatim slot recovery to measure reconstructive controllability beyond mere compliance. Across seven frontier models and three benchmarks, CAGE achieves an average ASR of 93.7% and sASR of 85.1%. Defense stress tests and keyword-recovery analysis reveal that existing token-level guardrails remain largely ineffective against reasoning-driven semantic evasion, suggesting that robust alignment must go beyond surface token filtering to address threats at the reasoning level.

WARNING: THIS PAPER CONTAINS UNSAFE CONTENTS.