Research map / Large language models / Language, safety and interpretability
Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Tree of Attacks with Pruning (TAP), a black-box automated jailbreaking method that branches attacker-LLM refinements and prunes off-topic and low-scoring prompts, achieving higher jailbreak rates with fewer queries than PAIR.
Problem
Automatically generating interpretable jailbreak prompts for black-box LLMs with high success rate and low query count.
Approach
Extends PAIR's iterative attacker-refinement loop into a tree: branching generates multiple refinements per prompt, and two pruning phases (off-topic check before querying, top-w score retention after) keep queries low while maintaining diversity.
Key results
- TAP achieves 94% jailbreak rate on GPT-4o versus 78% for PAIR, with about 60% fewer queries (16.2 vs 40.3).
- On GPT-4-Turbo, TAP reaches 84% jailbreak success with 22.5 mean queries versus PAIR's 44% with 47.1 queries.
- TAP reaches 96% on GeminiPro and 98% on PaLM-2 while using under 17 queries on average.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TAP instead of PAIR | GPT-4o target on AdvBench Subset · AdvBench Subset | jailbreak rate: 78% -> 94% | Helped |
| Use TAP instead of PAIR | GPT-4o target on AdvBench Subset · AdvBench Subset | mean target queries: 40.3 -> 16.2 | Helped |
| Use TAP instead of PAIR | GPT-4 target on AdvBench Subset · AdvBench Subset | jailbreak rate: 60% -> 90% | Helped |
| Use TAP instead of PAIR | GPT-4 target on AdvBench Subset · AdvBench Subset | mean target queries: 39.6 -> 28.8 | Helped |
| Add branching (branching factor 4 rather than 1) (ablation) | TAP on GPT-4-Turbo · AdvBench Subset | jailbreak rate: 48% -> 84% | Helped |
| Add branching (branching factor 4 rather than 1) (ablation) | TAP on GPT-4-Turbo · AdvBench Subset | mean target queries: 33.1 -> 22.5 | Helped |
| Add pruning of off-topic prompts (ablation) | TAP on GPT-4-Turbo · AdvBench Subset | mean target queries: 55.4 -> 22.5 | Helped |
| Add pruning of off-topic prompts (ablation) | TAP on GPT-4-Turbo · AdvBench Subset | jailbreak rate: 72% -> 84% | Helped |
Surprising findings
- Including off-topic prompts in the attacker's conversation history increases the chance later prompts are also off-topic, so pruning them is beneficial.
- Claude 3 Opus is the exception where TAP uses more queries (116.2) than PAIR (55.0) despite higher success.
Limitations
- Evaluated only on harmful-information requests from two datasets; performance may differ elsewhere.
- Relies on LLM judges (GPT-4) with 13% false positive rate, possibly inaccurate scoring.
- Closed-source target models change over time, so results are not reproducible in controlled fashion.
Experimental setup
Datasets: AdvBench Subset
Benchmarks: AdvBench Subset new 123-request harmful dataset
Metrics: jailbreak percentage (GPT4-Metric) human-judged jailbreak percentage mean number of queries to target transfer rate
Baselines: PAIR GCG TAP-No-Branch TAP-No-Prune
Builds on: PAIR Tree of Thoughts GCG
Closest papers by meaning
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.90)
- One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.90)
- Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.90)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.90)
- Injecting Universal Jailbreak Backdoors into LLMs in Minutes (ICLR 2025 · similarity 0.89)
- AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (ICLR 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.