Research map / Large language models / Language, safety and interpretability
VERA: Variational Inference Framework for Jailbreaking Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Casts black-box jailbreak prompt generation as variational inference, training a LoRA-adapted small attacker LLM with REINFORCE and a judge-based reward so it can sample diverse jailbreak prompts without per-prompt search.
Problem
Black-box jailbreaking of LLMs typically requires per-prompt optimization or search, depends on manually curated seed templates, and fails to characterize the breadth of a model's vulnerabilities for a given behavior.
Approach
Treats the attacker LLM as a variational distribution approximating the posterior over prompts that elicit harmful responses, optimizing an ELBO (likelihood via a judge score, prior from the base attacker, entropy regularization) with REINFORCE, so that after training new jailbreak prompts are sampled in a single forward pass.
Key results
- On HarmBench, VERA reaches 70.0% ASR on Vicuna-7b, 72.0% on Orca2-7b, and 48.5% on Gemini-Pro, with an average of 50.5% across eight targets, the best among black-box methods in the table.
- Under Circuit Breaker on Llama3-8B-Instruct, VERA keeps 9.6% ASR while AutoDAN and GCG drop to 0.0%.
- With a 1250s wall-clock budget, VERA produces over 5x more successful attacks than GPTFuzzer variants and 2.5x more than AutoDAN variants.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace the strongest reported baseline with VERA | HarmBench, Vicuna-7b · HarmBench, Vicuna-7b | ASR (%): 66.0 -> 70.0 | Helped |
| replace the strongest reported baseline with VERA | HarmBench, Baichuan2-7b · HarmBench, Baichuan2-7b | ASR (%): 61.5 -> 64.8 | Helped |
| replace the strongest reported baseline with VERA | HarmBench, Orca2-7b · HarmBench, Orca2-7b | ASR (%): 71.0 -> 72.0 | Helped |
| replace the strongest reported baseline with VERA | HarmBench, GPT-3.5 · HarmBench, GPT-3.5 | ASR (%): 47.5 -> 53.3 | Helped |
| replace the strongest reported baseline with VERA | HarmBench, Gemini-Pro · HarmBench, Gemini-Pro | ASR (%): 35.1 -> 48.5 | Helped |
| replace the strongest reported baseline with VERA | HarmBench average · HarmBench average | ASR (%): 40.9 -> 50.5 | Helped |
| apply VERA instead of AutoDAN under Perplexity Filter | Vicuna-7b · Vicuna-7b under Perplexity Filter | ASR (%): 48.8 -> 58.9 | Helped |
| apply VERA instead of AutoDAN under Circuit Breaker | Llama3-8B-Instruct · Llama3-8B-Instruct under Circuit Breaker | ASR (%): 0.0 -> 9.6 | Helped |
| enable attacker parameter updates rather than freeze the attacker (Best-of-N) (ablation) | VERA · VERA optimization ablation | ASR (%): 48.50 -> 94.00 | Helped |
| use Llama3-8B instead of Vicuna-7B attacker backbone (ablation) | VERA · Attacker backbone ablation | ASR (%): 94.00 -> 85.00 | Hurt |
| use Mistral-7B instead of Vicuna-7B attacker backbone (ablation) | VERA · Attacker backbone ablation | ASR (%): 94.00 -> 90.00 | Hurt |
| set KL coefficient to 0.0 instead of 0.8 (ablation) | VERA · KL coefficient ablation | ASR (%): 94.00 -> 76.53 | Hurt |
Surprising findings
- Best-of-N sampling from the same attacker reaches only 48.5% versus 94.0% for VERA in the ablation, which is inconsistent with the main-table ASR for Vicuna-7b (70.0%).
- The ablation reports 94.0% ASR while the main HarmBench table reports 70.0% on Vicuna-7b, and the conclusion cites up to 78.6%, suggesting differing evaluation settings.
Limitations
- Requires a separate training run for each harmful behavior, limiting scalability to large behavior sets.
- Training needs many black-box queries per behavior, which is costly for commercial APIs.
- Sparse rewards when all outputs are refused give flat, uninformative gradients, especially for robust targets.
Experimental setup
Datasets: HarmBench AdvBench
Benchmarks: HarmBench AdvBench
Metrics: attack success rate BLEU / self-BLEU diversity transferability ASR bypass rate JB rate
Baselines: GCG GCG-M GCG-T PEZ GBDA UAT AP SFS ZS PAIR TAP TAP-T
Builds on: REINFORCE GCG AutoDAN GPTFuzzer HarmBench
Closest papers by meaning
- VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models (ICML 2026 · similarity 0.91)
- GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (NeurIPS 2025 · similarity 0.90)
- Best-of-N Jailbreaking (NeurIPS 2025 · similarity 0.90)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.90)
- Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.90)
- LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs (NeurIPS 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.