Research map / Adversarial robustness and security / Black-box and transfer attacks
When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RLbreaker, a black-box jailbreaking attack that trains a PPO-based DRL agent to choose LLM-driven prompt mutators, guiding search for jailbreak prompts instead of random genetic search.
Problem
Black-box jailbreaking of aligned LLMs is inefficient because genetic and in-context attacks select prompt mutations randomly or without sequential refinement strategy, limiting attack success.
Approach
Model jailbreaking as a search problem and train a DRL agent (MLP policy over XLM-RoBERTa state embeddings) to select among five LLM-based prompt mutators, with a reward given by cosine similarity between the target response and an unaligned model's reference answer, optimized by a customized PPO that drops the value function and uses discounted returns directly.
Key results
- On Llama2-70b-chat (Full), RLbreaker reaches GPT-Judge 0.5250 vs 0.1500 for GPTFUZZER and 0.0094 for PAIR.
- On GPT-3.5-turbo (Full), RLbreaker reaches GPT-Judge 0.3688 vs 0.1031 for GPTFUZZER and 0.3000 for Cipher.
- RLbreaker is reported to retain effectiveness under perplexity, rephrasing, and RAIN defenses, and its trained agents transfer across target LLMs.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DRL-guided search instead of the strongest shown baseline | RLbreaker vs. PAIR · Llama2-70b-chat Full | GPT-Judge: 0.1468 -> 0.5250 | Helped |
| Use DRL-guided search instead of AutoDAN | RLbreaker vs. AutoDAN · Mixtral-8x7B-Instruct Full | Sim.: 0.7739 -> 0.7480 | Hurt |
| Use DRL-guided search instead of AutoDAN | RLbreaker vs. AutoDAN · Mixtral-8x7B-Instruct Full | GPT-Judge: 0.6750 -> 1.0000 | Helped |
| Replace the RL agent with a random agent (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge | Hurt |
| Replace the RL agent with an LLM agent (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge | Hurt |
| Use keyword matching as the reward instead of cosine similarity (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge | Hurt |
| Use token-level actions instead of mutator-based actions (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge: zeros | Hurt |
| Vary the reward threshold from 0.7 (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge | No clear effect |
| Change the helper model from GPT-3.5-turbo to Llama2-7b-chat (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge | No clear effect |
| Change the text encoder from Bge-large-en-v1.5 to all-MiniLM-L6-v2 (ablation) | RLbreaker · Llama2-7b-chat and GPT-3.5-turbo testing sets | GPT-Judge | No clear effect |
Surprising findings
- Replacing the RL agent with a random or LLM-based agent noticeably degrades GPT-Judge, and a token-level action space yields near-zero success.
- On Mixtral-8x7B-Instruct, AutoDAN and GPTFUZZER have slightly higher cosine similarity than RLbreaker despite lower GPT-Judge scores.
Limitations
- Reward based on cosine similarity to reference answers may produce false negatives when responses differ from the reference.
- Action space limited to five predefined mutators; does not include misspelling or encryption operators.
- Evaluated only on text-based LLMs; extension to multimodal models is future work.
Experimental setup
Datasets: AdvBench
Benchmarks: AdvBench
Metrics: attack success rate (keyword matching) cosine similarity (Sim.) harmful content detector GPT-Judge run time
Baselines: GPTFUZZER AutoDAN PAIR Cipher GCG
Builds on: PPO GPTFUZZER AutoDAN PAIR
Closest papers by meaning
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.88)
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.88)
- MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs (AAAI 2026 · similarity 0.88)
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · similarity 0.88)
- Improved Techniques for Optimization-Based Jailbreaking on Large Language Models (ICLR 2025 · similarity 0.88)
- Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.