Research map / Adversarial robustness and security / Attacks on text and graphs
AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AutoDAN-Turbo, a black-box lifelong-learning agent that automatically discovers, stores, and retrieves jailbreak strategies from attack logs to red-team LLMs, reaching 88.5 Harmbench ASR on GPT-4-1106-turbo.
Problem
Existing automatic jailbreak attacks lack explicit jailbreak knowledge, and strategy-based attacks rely on manually designed, single strategies, limiting diversity and effectiveness of red-teaming LLMs.
Approach
An attacker LLM, target LLM, scorer LLM, and summarizer LLM run an attack loop; strategies are extracted by summarizing differences between consecutive high/low-scoring attack attempts, stored in a library keyed by target response embeddings, and retrieved to guide future attacks; external human-designed strategies can be plugged into the library.
Key results
- AutoDAN-Turbo (Llama-3-70B attacker) achieves 57.7 average Harmbench ASR vs 33.1 for runner-up Rainbow Teaming, and 88.5 ASR on GPT-4-1106-turbo.
- Injecting 7 human-designed strategies raises GPT-4-1106-turbo ASR to 93.4 at Breakpoint 2.
- Test-time attacks reduce average successful query count by 87.0% relative to PAIR and TAP (6.72 queries average).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use lifelong strategy discovery and retrieval instead of baseline black-box attacks | AutoDAN-Turbo · Harmbench, average across victims | ASR: 33.1 -> 57.7 | Helped |
| use lifelong strategy discovery and retrieval instead of baseline black-box attacks | AutoDAN-Turbo · Harmbench, average across victims | StrongREJECT score: 0.13 -> 0.25 | Helped |
| use AutoDAN-Turbo rather than Rainbow Teaming | GPT-4-1106-turbo · Harmbench | ASR: 51.7 -> 88.5 | Helped |
| inject 7 human-designed strategies at Breakpoint 2 (ablation) | AutoDAN-Turbo (Gemma-7B-it) · Llama-2-7B-chat | ASR: 36.6 -> 40.8 (+4.2) | Helped |
| inject 7 human-designed strategies at Breakpoint 2 (ablation) | AutoDAN-Turbo (Llama-3-70B) · Llama-2-7B-chat | ASR: 34.3 -> 39.4 (+5.1) | Helped |
| inject 7 human-designed strategies at Breakpoint 2 (ablation) | AutoDAN-Turbo (Gemma-7B-it) · GPT-4-1106-turbo | ASR: 73.8 -> 81.9 (+8.1) | Helped |
| inject 7 human-designed strategies at Breakpoint 2 (ablation) | AutoDAN-Turbo (Llama-3-70B) · GPT-4-1106-turbo | ASR: 88.5 -> 93.4 (+4.9) | Helped |
| inject 7 human-designed strategies at Breakpoint 1 (ablation) | AutoDAN-Turbo (Gemma-7B-it) · GPT-4-1106-turbo | ASR: 73.8 -> 74.4 (+0.6) | Helped |
| inject 7 human-designed strategies at Breakpoint 1 (ablation) | AutoDAN-Turbo (Llama-3-70B) · GPT-4-1106-turbo | ASR: 88.5 -> 90.2 (+1.7) | Helped |
| use the learned strategy library rather than repeated query-based search | AutoDAN-Turbo · Test stage, average across victims | queries per successful jailbreak: 52.56 -> 6.72 | Helped |
Surprising findings
- Llama-2-70B-chat was less effective than smaller models as attacker/summarizer, despite having more parameters.
- Strategy libraries built on Llama-2-7B-chat transfer across attacker and target models and to unseen datasets with under 4% ASR drop.
Limitations
- High computational demand from loading multiple LLMs simultaneously.
- Building the strategy library from scratch requires repeated interactions between models.
Experimental setup
Datasets: HarmBench textual behaviors (400) 50-request initial malicious dataset unseen malicious requests dataset
Benchmarks: HarmBench StrongREJECT
Metrics: attack success rate StrongREJECT score total strategies found average jailbreak rounds average queries
Baselines: GCG-T PAIR TAP PAP-top5 Rainbow Teaming
Builds on: PAIR TAP HarmBench StrongREJECT
Closest papers by meaning
- AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (ICLR 2024 · similarity 0.89)
- When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search (NeurIPS 2024 · similarity 0.87)
- MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs (AAAI 2026 · similarity 0.87)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.87)
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · similarity 0.87)
- MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment (NeurIPS 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.