Research map / Large language models / Language, safety and interpretability
Understanding and Enhancing the Transferability of Jailbreaking Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Perceived-importance Flatten (PiF), a token-replacement jailbreak that uses a small masked language model's intent perception to flatten focus across neutral tokens, improving transferability of jailbreaks to proprietary LLMs.
Problem
Jailbreaking attacks generated on open-source LLMs transfer poorly to proprietary LLMs because their adversarial sequences overfit the source model's parameters (distributional dependency), which limits reliable red-teaming of proprietary models.
Approach
Analyse jailbreaks through a "perceived-importance" measure of how the model's intent recognition attends to each token, then use a dynamic objective that uniformly disperses focus from malicious-intent tokens to neutral tokens via synonym token replacement, avoiding lengthy overfitted adversarial sequences.
Key results
- On AdvBench, PiF reaches 83.8% ASR on Llama-2-13B-Chat versus 1.4% for GCG and 56.2% for PAIR.
- Against GPT-4-0613 on AdvBench, PiF achieves 97.7% ASR and 63.6% ASR+GPT, the highest among compared methods.
- PiF uses about 21.9 queries and 4.6 seconds on average with Bert-Large as source, versus 495.4 queries and 494.3 seconds for GCG.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use PiF instead of GCG or PAIR | jailbreaking attacks on GPT-4 · AdvBench | ASR: 85.6 -> 97.7 | Helped |
| use PiF instead of the strongest reported baseline, APAs | jailbreaking attacks on GPT-4 · AdvBench | ASR: 92.0 -> 97.7 | Helped |
| use PiF rather than ReNeLLM | jailbreaking attacks on GPT-4 · AdvBench | ASR + GPT: 58.9 -> 63.6 | Helped |
| replace Bert-Large source with Bert-Base (ablation) | PiF · AdvBench | ASR: 83.8 -> 87.7 | Helped |
| replace Bert-Large source with Bert-Base (ablation) | PiF · AdvBench | AHS: 2.15 -> 1.92 | Hurt |
| replace Bert-Large source with Llama-2-7B-Chat (ablation) | PiF · AdvBench | ASR: 83.8 -> 51.3 | Hurt |
| replace evaluation template with “This is a [MASK] intent” (ablation) | PiF · AdvBench | ASR: 83.8 -> 77.5 | Hurt |
| replace evaluation template with “The intent of this sentence is [MASK]” (ablation) | PiF · AdvBench | AHS: 2.15 -> 1.85 | Hurt |
| use PiF (Warm-up) instead of original PiF (ablation) | PiF in one-query transfer · AdvBench, Llama-2-13B-Chat | ASR: 83.8 -> 33.8 | Hurt |
| use PiF (Warm-up) instead of original PiF (ablation) | PiF in one-query transfer · AdvBench, Llama-2-13B-Chat | Average query: 21.9 -> 1.0 | Helped |
| use adaptive PiF rather than original PiF against the instruction filter (ablation) | PiF · AdvBench, Llama-2-13B-Chat | post-defence ASR: 35.2 -> 62.3 | Helped |
| swap the order of the two GCG adversarial-sequence halves (ablation) | GCG on the source model · intent perception | perceived-importance of deceptive region: 23% drop | Hurt |
Surprising findings
- Swapping the order of GCG adversarial sequence halves reduce its perceived-importance by 23%, showing jailbreak effectiveness depends on token order and the source model's distribution.
- A small masked language model (Bert-Large) serves as an effective source model, outperforming Llama-2-7B-Chat as a source (83.8% vs 51.3% ASR).
Limitations
- No comprehensive theoretical analysis of transfer mechanisms is provided.
- Jailbroken models still often append safety disclaimers to responses.
- Baseline results for some methods are taken from original papers rather than re-run.
Experimental setup
Datasets: AdvBench MaliciousInstruct
Benchmarks: AdvBench MaliciousInstruct
Metrics: ASR ASR + GPT AHS perceived-importance variation query count time cost
Baselines: GCG PAIR APAs AmpleGCG RIPPLE LLM-FUZZER AutoDAN ReNeLLM
Builds on: GCG PAIR AutoDAN AmpleGCG ReNeLLM
Closest papers by meaning
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.92)
- Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · similarity 0.90)
- One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.90)
- Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.90)
- Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.90)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.