Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Models
2026-08-10 • Computation and Language
Computation and Language
AI summaryⓘ
The authors explain that while large language models (LLMs) have safety measures to avoid harmful outputs, attackers can still trick them using subtle language cues. They point out that because human language relies on unspoken context like social norms and world knowledge, these hidden meanings aren’t fully considered in current safety methods. This mismatch creates new vulnerabilities called pragmatic attacks, where the attacker exploits implied meanings to bypass safety. Their experiments show their new attack method is more effective than previous ones on many LLMs.
large language modelsLLM safetynatural language attackspragmaticscontextual understandingsafety alignmentattack surfacesocial normsworld knowledgeprompt manipulation
Authors
Bocheng Chen, Han Zi, Roucheng Ou, Yawei Liu, Minyue Chen, Zimo Qi, Rongrong Wang, Guangliang Liu
Abstract
In the era of large language models (LLMs), attackers often manipulate natural language to elicit unsafe or harmful outputs, creating a new natural language attack surface unique to LLM-based systems, where attacks directly exploit explicit linguistic cues in user prompts to bypass the safety mechanism of LLMs. However, such attacks can often be mitigated by existing safety alignment algorithms. On the other hand, human language is inherently grounded in pragmatics, necessitating typical context to interpret language, e.g., world knowledge, social norms. However, such contexts are often implicit because they are not directly expressed in human language and are not sufficiently leveraged in safety alignment, creating a fundamental mismatch between human language interpretation and safety alignment approaches. In this paper, we demonstrate that this mismatch exposes vulnerabilities in LLMs. We refer to this vulnerability as the pragmatic attack surface, which can be exploited to achieve high attack success rates. The experimental results demonstrate that our proposed approach outperforms baseline attack methods across various open-source and closed-source models by a substantial margin.