Research map / Large language models / Language, safety and interpretability
Jailbroken: How Does LLM Safety Training Fail?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Combine multiple simple jailbreak techniques | GPT-4 · Curated harmful prompts (32) | Bad Bot rate: 0.03 -> 0.94 | Helped |
| Combine multiple simple jailbreak techniques | Claude v1.3 · Curated harmful prompts (32) | Bad Bot rate: 0.00 -> 0.81 | Helped |
| Combine multiple simple jailbreak techniques | GPT-4 · Synthetic harmful prompts (317) | Bad Bot rate: 0.93 $\pm$ 0.03 | Helped |
| Combine multiple simple jailbreak techniques | Claude v1.3 · Synthetic harmful prompts (317) | Bad Bot rate: 0.87 $\pm$ 0.04 | Helped |
| Use a targeted injected prefix rather than "Hello!" (ablation) | GPT-4 prefix injection · Curated harmful prompts (32) | Bad Bot rate: 0.06 -> 0.22 | Helped |
| Use refusal-suppressing rules rather than inverted rules (ablation) | GPT-4 refusal suppression · Curated harmful prompts (32) | Bad Bot rate: 0.00 -> 0.25 | Helped |
| Encode the input and request encoded output rather than encoding input only (ablation) | GPT-4 Base64 attack · Curated harmful prompts (32) | Bad Bot rate: 0.09 -> 0.34 | Helped |
| Request encoded output while keeping the input plain text (ablation) | GPT-4 Base64 attack · Curated harmful prompts (32) | Bad Bot rate: 0.34 -> 0.06 | Hurt |
| Use a raw Base64 prompt without additional instructions (ablation) | GPT-4 Base64 attack · Curated harmful prompts (32) | Bad Bot rate: 0.34 -> 0.16 | Hurt |
| Choose an attack adaptively for each prompt | GPT-4 · Synthetic harmful prompts (317) | Bad Bot rate: 0.96 | Helped |
| Choose an attack adaptively for each prompt | Claude v1.3 · Synthetic harmful prompts (317) | Bad Bot rate: 0.99 | Helped |
| Use complex combination attacks rather than simple roleplay attacks | GPT-3.5 Turbo · Curated harmful prompts | Bad Bot rate | Mixed |
Closest papers by meaning
- WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models (NeurIPS 2024 · similarity 0.93)
- Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.91)
- Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions (ICML 2025 · similarity 0.90)
- Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.90)
- The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · similarity 0.90)
- Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts? (ICLR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.