Research map / Large language models / Language, safety and interpretability
All You Need Is S P A C E: When Jailbreaking Meets Bias Audit and Reveals What Lies Beneath the Guardrails (Student Abstract)
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Combines a space-separated-character prompt jailbreak with a simplified toxicity rabbit hole bias audit to show jailbroken Llama3 generates antisemitic, racist, misogynistic and homophobic toxic content across 20 identity groups.
Problem
Bias audits of LLMs become outdated as guardrails patch the vulnerabilities they exploit; the biases of Llama3 under jailbreaking remained unexplored.
Approach
Integrate a jailbreak (space-separated characters that evade Prompt-Guard-86M) with an iterative toxicity rabbit hole audit to elicit and measure toxic content about 20 identity groups from Llama3.
Key results
- Offensive content rose from 55.81% (base Llama3) to 66.03% (jailbroken Llama3); Llama2 reached 88.67%.
- Collective violence references increased from 13.19% to 17.23% under jailbreak.
- Necessity-modal usage roughly doubled from 10.82% to 20.67% when jailbroken.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply the space-separated-character jailbreak to Llama3's audit prompt | Llama3 · 20 identity groups, 1,000 generations per group | Offensive expansion: 55.81% -> 66.03% | Hurt |
| Apply the space-separated-character jailbreak to Llama3's audit prompt | Llama3 · 20 identity groups, 1,000 generations per group | Collective violence: 13.19% -> 17.23% | Hurt |
| Apply the space-separated-character jailbreak to Llama3's audit prompt | Llama3 · 20 identity groups, 1,000 generations per group | Necessity modals: 10.82% -> 20.67% | Hurt |
| Use Llama3 instead of Llama2 | Llama2 · 20 identity groups, 1,000 generations per group | Offensive expansion: 88.67% -> 55.81% | Helped |
| Use Llama3 instead of Llama2 | Llama2 · 20 identity groups, 1,000 generations per group | Collective violence: 12.11% -> 13.19% | Hurt |
| Use Llama3 instead of Llama2 | Llama2 · 20 identity groups, 1,000 generations per group | Necessity modals: 9.96% -> 10.82% | Hurt |
Surprising findings
- Llama3 is not a substantial safety improvement over Llama2, which showed higher offensive content (88.67%).
Limitations
- Simplified version of the toxicity rabbit hole framework
- Single jailbreak technique tested on one model family
- Reliance on GPT-4o for labeling violent content
Experimental setup
Datasets: Social Bias Frames (SBIC) TRH dataset (Dutta et al. 2024)
Benchmarks: bias audit over 20 identity groups
Metrics: offensive content rate collective violence rate necessity modal rate outcome homogenization
Baselines: Llama2 Llama3 (non-jailbroken) PaLM2 Mistral Tulu
Builds on: toxicity rabbit hole framework Prompt-Guard-86M jailbreak
Closest papers by meaning
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.83)
- Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters (NeurIPS 2024 · similarity 0.82)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.82)
- A StrongREJECT for Empty Jailbreaks (NeurIPS 2024 · similarity 0.82)
- Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.82)
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.