Research map / Large language models / Language, safety and interpretability
AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AutoDAN, a hierarchical genetic algorithm that automatically generates stealthy, semantically meaningful jailbreak prompts against aligned LLMs.
Problem
Aligned LLMs remain vulnerable to jailbreak prompts; handcrafted prompts are readily detected by perplexity filters and gradient-based attacks like GCG produce unreadable gibberish, so stealthy automatically generated jailbreaks are needed.
Approach
A hierarchical genetic algorithm evolves readable jailbreak prompts starting from handcrafted DAN-style seed prompts, with a sentence-level crossover and paragraph-level mutation guided by an objective fitness on the target model, yielding low-perplexity prompts that bypass defenses.
Key results
- AutoDAN achieves high attack success rates on aligned models while producing readable prompts with low perplexity, unlike GCG's gibberish suffixes.
- AutoDAN remains effective against perplexity-based defenses that filter GCG attacks.
Limitations
- Relies on handcrafted seed prompts for initialization
- Evaluation text in provided extract is largely template content, so details are limited
Experimental setup
Datasets: AdvBench harmful behaviors
Benchmarks: AdvBench
Metrics: attack success rate perplexity
Baselines: GCG handcrafted DAN PAIR perplexity filter defense
Builds on: GCG DAN-style handcrafted jailbreaks
Closest papers by meaning
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.93)
- One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.92)
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.91)
- Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models (NeurIPS 2026 · similarity 0.91)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.90)
- Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.