Research map / Adversarial robustness and security / Attacks on text and graphs

An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks

ICML 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes an interpretable bigram (N-gram) perplexity threat model built on 1T Dolma tokens, adapts popular jailbreak attacks to it, and benchmarks them on equal footing against safety-tuned LLMs.

Problem

Jailbreak attacks on LLMs vary widely in fluency and compute cost, so their attack success rates are not comparable; LLM-based perplexity filters are model-dependent, non-interpretable, and costly to evaluate.

Approach

Define a jailbreak as valid in a threat model if its bigram N-gram perplexity over rolling 8-token windows stays below a threshold calibrated to 99.9% TPR on natural text; adapt GCG, PRS, AutoDAN, BEAST, and PAIR to satisfy this filter and compare them under equal constraints, using the N-gram LM for interpretability analysis.

Key results

• Adaptive PRS achieves average ASR 0.82 under the N-gram threat model versus 0.89 for unconstrained PRS, and is the strongest attack across the evaluated models (e.g., 0.96 on Llama3.1-8b).
• Low-perplexity attacks (AutoDAN, BEAST, PAIR) reach average ASR of 0.19, 0.10, and 0.13 under the constraint, below adaptive GCG (0.24) and PRS.
• On Llama2-7b, the N-gram perplexity filter at 99.9% TPR (threshold 38,276) reduces ASR from 0.90 to 0.62 for adaptive PRS while the Self-PPL variants reach the same ASR at roughly 5-7x higher FLOPs.

Measured effects reported in the paper

Surprising findings

• Attack success rates against safety-tuned modern models are lower than previously reported, and discrete-optimization attacks (PRS, GCG) outperform recent LLM-based attacks (PAIR, AutoDAN) under the constraint.
• The N-gram filter rejects 41.8% of translated queries on average for morphologically hard languages and 15.5% for simple ones, indicating English-centric limitations.

Limitations

• Filter is based on bigram statistics from an English-dominant corpus (Dolma) and rejects many non-English queries.
• Attacks assume white-box access for GCG and PRS and rely on a judge model whose agreement with humans is imperfect (accuracy 0.84-0.92).
• Threat model uses the Llama2 tokenizer for all models, which may not match each model's tokenizer.

Experimental setup

Datasets: Dolma HarmBench cleaned Alpaca

Benchmarks: HarmBench

Metrics: attack success rate total FLOPs TPR FPR

Baselines: GCG PRS AutoDAN BEAST PAIR

Builds on: GCG PRS PAIR AutoDAN BEAST HarmBench Infini-gram

Closest papers by meaning

• Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models (NeurIPS 2026 · similarity 0.92)
• Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · similarity 0.92)
• One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.91)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.91)
• Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions (ICML 2025 · similarity 0.91)
• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.91)