Research map / Large language models / Language, safety and interpretability
Semantic Representation Attack against Aligned Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Semantic Representation Attack (SRA) and the SRHS tree search, which jailbreaks aligned LLMs by targeting a family of semantically equivalent harmful responses under a perplexity-coherence constraint, reporting 89.41% average ASR across 18 LLMs.
Problem
Automated jailbreak attacks on aligned LLMs typically target exact affirmative responses (e.g., "Sure, here is"), which yields limited convergence, unnatural prompts, and high compute cost.
Approach
Instead of optimizing for one exact target string, the attack targets a semantic representation covering many equivalent harmful responses, and searches prompts incrementally by extending tokens only while they keep low perplexity and high token probability, guided by a harmfulness classifier.
Key results
- Averaged across 18 LLMs, SRA achieves 89.41% ASR versus 71.60% for the next best method (AutoDAN).
- Reaches 100% ASR on 11 of 18 evaluated models, including Vicuna 13B (previous best 87.50% by GCG).
- Under a 15s budget on Vicuna 7B, SRA reaches 95.77% ASR with mean PPL 24.21, versus 75.19% and PPL 60.55 for AutoDAN.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use semantic representation targeting with SRHS rather than the strongest baseline attack | aligned LLM attacks across 18 models · 18 LLMs (averaged) | ASR: 71.60 -> 89.41 | Helped |
| use SRA rather than GCG | attacks on Llama 2 7B · Llama 2 7B | ASR: 46.25 -> 30.33 | Hurt |
| use SRA rather than the strongest baseline | attacks on R2D2 7B · R2D2 7B | ASR: 77.25 -> 42.00 | Hurt |
| use SRA rather than BEAST under a 15-second budget | Vicuna 7B · Vicuna 7B, 15s | ASR: 77.12 -> 95.77 | Helped |
| use SRA rather than AutoDAN under a 15-second budget | Vicuna 13B · Vicuna 13B, 15s | ASR: 39.27 -> 86.73 | Helped |
| use SRA rather than AutoDAN under a 15-second budget | Mistral 7B · Mistral 7B, 15s | PPL: 115.72 -> 36.75 | Helped |
| use SRA rather than AutoDAN under a 15-second budget | Guanaco 7B · Guanaco 7B, 15s | ASR under PPL defense: 99.42 -> 99.62 | No clear effect |
| transfer SRA prompts instead of AutoDAN prompts from Vicuna 7B to Vicuna 13B | cross-model attack transfer · Vicuna 7B → Vicuna 13B, 15s | ASR: 28.46 -> 84.42 | Helped |
| set semantic threshold τ to 10 rather than 20 (ablation) | SRA · Vicuna 13B, 15s | ASR: 86.73 -> 86.15 | No clear effect |
| set semantic threshold τ to 100 rather than 20 (ablation) | SRA · Vicuna 13B, 15s | ASR: 86.73 -> 77.69 | Hurt |
| set semantic threshold τ to 200 rather than 20 (ablation) | SRA · Vicuna 13B, 15s | ASR: 86.73 -> 77.69 | Hurt |
| set semantic threshold τ to 1000 rather than 20 (ablation) | SRA · Vicuna 13B, 15s | ASR: 86.73 -> 75.38 | Hurt |
Surprising findings
- The paper reports 100% ASR on DeepSeek R1 8B and several Vicuna, Koala, and Orca variants with concise prompts, despite these models' alignment levels.
Limitations
- Requires logit/probability access to the target model, so it does not apply to closed-source systems.
- Performance is sensitive to the coherence threshold tau; values below 20 eliminated viable candidates.
- Depends on an accurate semantic representation mapping, which varies across architectures and training paradigms.
Experimental setup
Datasets: HarmBench AdvBench
Benchmarks: HarmBench AdvBench
Metrics: attack success rate perplexity ASR under perplexity defense
Baselines: GCG GCG-M GCG-T PEZ GBDA UAT AP SFS ZS PAIR TAP AutoDAN
Builds on: GCG BEAST HarmBench
Closest papers by meaning
- REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective (ICML 2025 · similarity 0.89)
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.89)
- Representation Noising: A Defence Mechanism Against Harmful Finetuning (NeurIPS 2024 · similarity 0.88)
- RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content (ICML 2024 · similarity 0.88)
- A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1 (NeurIPS 2025 · similarity 0.88)
- Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignment (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.