Modern Large Language Models (LLMs) depend heavily on surface-level lexical filters for safety alignment, exposing a critical lexical-semantic gap: harmful intent can be fully decoupled from explicit wording. Motivated by this vulnerability, we propose CAGE (Concept Algebra for Guardrail Evasion), a single-turn black-box jailbreak leveraging the victim’s reasoning to reconstruct masked harmful intent. Through slot masking and concept equations, CAGE eliminates explicit triggers while guiding the target model to internally deduce the payload. Because standard evaluations conflate generic harmfulness with precise intent execution, we introduce the Strict Attack Success Rate (sASR), a metric that mandates verbatim slot recovery to measure reconstructive controllability beyond mere compliance. Across seven frontier models and three benchmarks, CAGE achieves an average ASR of 93.7% and sASR of 85.1%. Defense stress tests and keyword-recovery analysis reveal that existing token-level guardrails remain largely ineffective against reasoning-driven semantic evasion, suggesting that robust alignment must go beyond surface token filtering to address threats at the reasoning level.

WARNING: THIS PAPER CONTAINS UNSAFE CONTENTS.

Lightweight Large Language Models (LwLLMs) are reduced-parameter, optimized models designed to run efficiently on consumer-grade hardware, offering significant advantages in resource efficiency, cost-effectiveness, and data privacy. However, these models often struggle with limited inference and reasoning capabilities, which restrict their performance on complex tasks and limit their practical applicability. Moreover, existing prompt optimization methods typically rely on extensive manual effort or the meta-cognitive abilities of state-of-the-art LLMs, making them less effective for LwLLMs.To address these challenges, we introduce DeBoP, a new Direct Behavior Optimization Paradigm, original from the Chain-of-Thought (CoT) prompting technique. Unlike CoT Prompting, DeBoP is an automatic optimization method, which focuses on the optimization directly on the behavior of LwLLMs. In particular, DeBoP transforms the optimization of complex prompts into the optimization of discrete, quantifiable execution sequences using a gradient-free Monte Carlo Tree Search. We evaluate DeBoP on seven challenging tasks where state-of-the-art LLMs excel but LwLLMs generally underperform. Experimental results demonstrate that DeBoP significantly outperforms recent prompt optimization methods on most tasks. In particular, DeBoP-optimized LwLLMs surpass GPT-3.5 on most tasks while reducing computational time by approximately 60% compared to other automatic prompt optimization methods.