Research map / Large language models / Language, safety and interpretability

LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs

NeurIPS 2025 · Large language models › Language, safety and interpretability · approach: Jailbreak attacks and defenses · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes LARGO, a jailbreak attack that optimizes a continuous latent suffix embedding by gradient descent, then has the target LLM decode it into natural-language suffixes via self-reflection, iterating until success.

Problem

Gradient-based jailbreak attacks struggle in discrete language space, producing illegible token suffixes (e.g., GCG) that perplexity filters catch, while LLM-driven attacks need human prototyping or attacker training. The paper seeks fluent, effective, transferable jailbreaks.

Approach

Optimize an adversarial latent suffix in the continuous embedding space with cross-entropy toward an affirmative target, then recursively prompt the same instruction-tuned LLM to interpret the latent into readable text, and project the text back to embeddings for refinement.

Key results

• On AdvBench with Llama-2-7B, LARGO reaches 42.0% keyword ASR versus 39.0% for GCG, 18.0% for AutoDAN and 2.0% for AdvPrompter.
• On JailbreakBench with Llama-2-13B, LARGO reaches 58.0% ASR versus 24.0% for GCG; in the universal setting on Llama-2-7B it reaches 22.0% ASR versus 9.5% for GCG with perplexity 18.54 versus 1094.11.
• Transfer from Llama-2-13B to Llama-2-7B yields up to 31.37% success, and Phi-3 to Qwen-2.5-14B yields 13.29%.

Measured effects reported in the paper

Surprising findings

• Random latent vectors interpreted through the same decoding process still yield fluent text but achieve only 2.0-5.5% ASR, versus 42-79% for optimized latents.
• Suffix length strongly affects success: ASR rises from 13.0% at 50 tokens to 65.0% at 300 tokens on Llama-2-7B.

Limitations

• Keyword-based ASR is the default metric; under StrongREJECT scores drop (e.g., LARGO 28.0 on Llama-2-7B), and the keyword lists are manually extracted per prompt.
• Requires white-box gradient access to the source model for latent optimization; transfer performance is uneven across models.
• Successful suffixes use 200 tokens, so they are long, and the universal attack results are modest in absolute ASR.

Experimental setup

Datasets: AdvBench JailbreakBench

Benchmarks: AdvBench JailbreakBench

Metrics: keyword-based attack success rate StrongREJECT score GPT-2 perplexity

Baselines: GCG AutoDAN AdvPrompter

Builds on: GCG AutoDAN AdvPrompter SelfIE LatentQA

Closest papers by meaning

• GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (NeurIPS 2025 · similarity 0.91)
• VERA: Variational Inference Framework for Jailbreaking Large Language Models (NeurIPS 2025 · similarity 0.90)
• Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.89)
• Fight Back Against Jailbreaking via Prompt Adversarial Tuning (NeurIPS 2024 · similarity 0.89)
• AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.89)
• Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes (NeurIPS 2024 · similarity 0.89)