Research map / Large language models / Language, safety and interpretability

Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs

ICML 2025 · Large language models › Language, safety and interpretability · approach: Jailbreak elicitation and risk · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ICRT, a two-stage jailbreak attack that decomposes malicious intent into simple sub-concepts and reassembles them in contextual templates, plus a ranking-based (Elo, HodgeRank, Rank Centrality) harmfulness evaluation metric.

Problem

LLMs remain vulnerable to jailbreak attacks, and existing evaluations rely on binary attack success rates that fail to capture differences in the harmfulness of generated content.

Approach

Inspired by the simplicity effect and relevance bias from human cognition, ICRT uses an auxiliary LLM to extract intent, decompose it into low-complexity sub-concepts, select the sub-concepts most relevant to intent, and embed them in role-play or hypothetical templates iteratively; harmfulness is measured by majority-voted pairwise LLM comparisons aggregated with rank-aggregation methods.

Key results

• ICRT achieves 98.2% average ASR on AdvBench across six target models, versus 92.2% for JailBroken and 82.2% for CodeChameleon (the baseline average reported).
• Under no defense, ICRT achieves 97% on Vicuna and 96% on GPT-4 against black-box settings, versus PAIR's 59% and 20% respectively.
• ICRT ranks first across Elo (ELO-R, ELO-A), HodgeRank and Rank Centrality harmfulness rankings.

Measured effects reported in the paper

Surprising findings

• Many outputs judged as successful jailbreaks by binary ASR are vague or generic, with equal top hazard scores despite differing actionable content.

Limitations

• Relies on LLM-based judging for harmfulness and ASR, which may misclassify vague outputs as harmful.
• Evaluation of harmfulness uses only pairwise LLM comparisons across attack methods without human validation.

Experimental setup

Datasets: AdvBench NeurIPS 2024 Red Teaming Track

Benchmarks: AdvBench NeurIPS 2024 Red Teaming Track

Metrics: attack success rate Elo rating HodgeRank score Rank Centrality score

Baselines: JailBroken DeepInception ICA CodeChameleon MultiLingual Cipher ReNeLLM GPTFUZZER AutoDAN PAIR GCG GCG-Transfer

Builds on: EasyJailbreak GPTFUZZER ReNeLLM AutoDAN PAIR

Closest papers by meaning

• Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions (ICML 2025 · similarity 0.91)
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.91)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.90)
• Look Before You Leap: Enhance Attention and Vigilance Regarding Harmful Content with GuidelineLLM (AAAI 2025 · similarity 0.90)
• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.90)
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.90)