Research map / Large language models / Language, safety and interpretability

Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling

NeurIPS 2024 · Large language models › Language, safety and interpretability · approach: Parallel and early-exit decoding · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Probe Sampling, which uses a small draft model's loss rankings, calibrated by a Spearman agreement score on a small probe set, to filter GCG adversarial-suffix candidates before target-model evaluation, yielding 2-6x speedups while matching or improving ASR.

Problem

GCG adversarial suffix optimization is time-consuming because each of its B=512 candidate suffixes requires a full forward pass through the large target LLM, which limits practical study of LLM safety.

Approach

Use a small draft model to score all candidates, measure draft-target agreement on a small probe set via Spearman rank correlation, and adaptively choose how many top candidates to re-evaluate with the target model; the same idea is applied to AutoPrompt, APE and AutoDAN.

Key results

• On AdvBench with Llama2-7b-chat, probe sampling with simulated annealing gives 5.6x speedup (Human Behaviors) and 6.3x (Human Strings) with ASR 74.0 vs GCG 69.0 on individual behaviors.
• Probe sampling accelerates AutoPrompt by 1.8x, APE by 2.3x on GSM8K, 1.8x on MMLU and 3.0x on BBH, with minimal accuracy change.
• AutoDAN-GA and AutoDAN-HGA are accelerated by 2.3x and 2.5x respectively with comparable ASR.

Measured effects reported in the paper

Surprising findings

• Probe sampling yields higher ASR than plain GCG (e.g., 81.0 vs 69.0 on individual behaviors with Llama2), which the authors attribute to added randomness rather than the acceleration itself.
• Sheared-LLaMA as draft model achieves the highest ASR (91.0) while GPT-2 gives the best speedup, indicating a speed-quality trade-off in draft model choice.

Limitations

• Slow performance on large test sets according to the authors
• Only applicable to open-source models where draft and target logits are accessible
• ASR measured by refusal-phrase matching, an imperfect proxy for harmfulness

Experimental setup

Datasets: AdvBench SST-2 SICK-E GSM8K BBH MMLU

Benchmarks: AdvBench SST-2 SICK-E GSM8K BBH MMLU

Metrics: attack success rate accuracy wall-clock time per iteration FLOPs

Baselines: GCG GCG + Annealing AutoDAN-GA AutoDAN-HGA AutoPrompt APE

Builds on: GCG speculative sampling AutoPrompt APE AutoDAN

Closest papers by meaning

• REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective (ICML 2025 · similarity 0.89)
• Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.88)
• AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.88)
• GReaTer: Gradients Over Reasoning Makes Smaller Language Models Strong Prompt Optimizers (ICLR 2025 · similarity 0.87)
• Enhancing Large Language Model Performance with Gradient-Based Parameter Selection (AAAI 2025 · similarity 0.87)
• Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Sampling (NeurIPS 2026 · similarity 0.87)