Research map / Large language models / Reasoning and chain of thought
Adversarial Reasoning at Jailbreaking Time
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Frames LLM jailbreaking as a reasoning problem, using a target-model loss as a verifier to guide a tree search over reasoning strings that feed an attacker LLM, achieving state-of-the-art attack success rates on aligned models.
Problem
Automatic jailbreaking of aligned LLMs, where existing semantic-space attacks rely on sparse binary judge feedback and token-space attacks produce gibberish, leaving them weak against adversarially trained and reasoning-based safeguard models.
Approach
Uses the target's cross-entropy loss of an affirmative target string as a continuous, step-wise verifier. A Feedback LLM compares loss-ordered attacker prompts, a Refiner LLM turns that feedback into child reasoning strings, and a Go-with-the-Winners-style buffer search with backtracking explores the tree. Attacks are gradient-free and need only forward passes on white-box models.
Key results
- On white-box targets, Adversarial Reasoning reaches 88% ASR on Llama-3-8B and 70% on Mistral-7B-v2-RR versus 40% for the best baseline TAP-T, and 44% on Llama-3-8B-RR versus 32% for TAP-T.
- Multi-shot transfer reaches 56% ASR on OpenAI o1-preview (vs 16% reported for prior attack), 94% on GPT-4o, and 96% on Llama-3.1-405B.
- Reports 100% ASR on DeepSeek-R1 using the aggregated surrogate loss.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use loss-guided adversarial reasoning instead of Adaptive Attack | Llama-2-7B · Llama-2-7B | ASR: 48% -> 60% | Helped |
| Use Adaptive Attack instead of loss-guided adversarial reasoning | Llama-3-8B · Llama-3-8B | ASR: 100% -> 88% | Hurt |
| Use loss-guided adversarial reasoning instead of TAP-T | Llama-3-8B-RR · Llama-3-8B-RR | ASR: 32% -> 44% | Helped |
| Use loss-guided adversarial reasoning instead of AutoDAN-Turbo | Mistral-7B-v2-RR · Mistral-7B-v2-RR | ASR: 40% -> 70% | Helped |
| Use loss-guided adversarial reasoning instead of heuristic PAIR with Vicuna | Llama-3-8B · Llama-3-8B | ASR: 20% -> 64% | Helped |
| Use multi-shot transfer with the Llama-2-7B surrogate instead of one-shot transfer | GPT-4o · GPT-4o | ASR: 34% -> 94% | Helped |
| Aggregate losses from multiple surrogate models instead of using Llama-3-RR alone | Multi-shot transfer · o1-preview | ASR: 30% -> 56% | Helped |
| Use loss-guided adversarial reasoning instead of heuristic PAIR with DeepSeek-R1 | Claude-3.5-Sonnet · Claude-3.5-Sonnet | ASR: 16% -> 36% | Helped |
| Reverse the order of attacking prompts supplied to Feedback LLM (ablation) | Adversarial Reasoning · 10 selected HarmBench goals | successful goals: 10/10 -> 5/10 | Hurt |
| Shuffle the order of attacking prompts supplied to Feedback LLM (ablation) | Adversarial Reasoning · 10 selected HarmBench goals | successful goals: 10/10 -> 4/10 | Hurt |
| Use heuristic PAIR with DeepSeek-R1 instead of loss-guided reasoning (ablation) | o1-preview · o1-preview | ASR: 56% -> 16% | Hurt |
| Continue loss-guided search beyond the third iteration rather than relying on PAIR | Adversarial Reasoning vs PAIR · Llama-2-7B | share of successful jailbreaks after the third iteration: 11% -> 37% | Helped |
Surprising findings
- PAIR run with DeepSeek-R1 as the attacker does not outperform PAIR with Mixtral, suggesting stronger reasoning attackers do not help without loss-guided supervision.
- Vicuna-13B as attacker with this method (64%) nearly matches PAIR with Mixtral (66%) on Llama-3-8B.
Limitations
- White-box log-prob access is needed for the loss verifier, so black-box targets rely on transfer from surrogate models.
- Query cost per success is higher than PAIR and TAP-T, and it depends on external API calls for attacker, feedback, and refiner.
- Relies on manual expert verification of judge-positive jailbreaks, so evaluation is partly subjective.
Experimental setup
Datasets: HarmBench behaviors
Benchmarks: HarmBench
Metrics: attack success rate queries per success loss progression iteration distribution of jailbreaks
Baselines: GCG PAIR TAP-T Rainbow Teaming AutoDAN-Turbo Adaptive Attack
Builds on: PAIR TAP Greedy Coordinate Gradient Go-with-the-Winners TextGrad
Closest papers by meaning
- Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence (NeurIPS 2025 · similarity 0.91)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.91)
- Understanding and Enhancing the Transferability of Jailbreaking Attacks (ICLR 2025 · similarity 0.90)
- Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · similarity 0.90)
- Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · similarity 0.90)
- Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes (NeurIPS 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.