Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Models

2026-08-10

AI Summary

Current safety alignment mechanisms in large language models fail to account for implicit contextual cues—such as commonsense knowledge and social norms—that are not explicitly stated, rendering them vulnerable to pragmatic attacks and creating a fundamental mismatch with human language understanding. This work introduces the novel concept of the “pragmatic attack surface,” integrating principles from pragmatics and adversarial attack techniques to devise a method that manipulates implicit context to induce harmful model outputs. The proposed approach significantly outperforms existing attack baselines across multiple mainstream open- and closed-source large language models, achieving substantially higher attack success rates. These findings expose systemic vulnerabilities in current safety mechanisms and establish a new direction for research on aligning large language models with human intent.

Abstract

In the era of large language models (LLMs), attackers often manipulate natural language to elicit unsafe or harmful outputs, creating a new natural language attack surface unique to LLM-based systems, where attacks directly exploit explicit linguistic cues in user prompts to bypass the safety mechanism of LLMs. However, such attacks can often be mitigated by existing safety alignment algorithms. On the other hand, human language is inherently grounded in pragmatics, necessitating typical context to interpret language, e.g., world knowledge, social norms. However, such contexts are often implicit because they are not directly expressed in human language and are not sufficiently leveraged in safety alignment, creating a fundamental mismatch between human language interpretation and safety alignment approaches. In this paper, we demonstrate that this mismatch exposes vulnerabilities in LLMs. We refer to this vulnerability as the pragmatic attack surface, which can be exploited to achieve high attack success rates. The experimental results demonstrate that our proposed approach outperforms baseline attack methods across various open-source and closed-source models by a substantial margin.

Problem

• pragmatic attack surface
• large language models
• implicit context
• safety alignment
• natural language vulnerabilities

Innovation

• pragmatic attack surface
• implicit context
• language model safety
• adversarial attacks
• safety alignment