Research map / Large language models / Language, safety and interpretability
Improved Techniques for Optimization-Based Jailbreaking on Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Improves GCG jailbreaking by using diverse harmful-guidance target templates, an adaptive multi-coordinate update strategy, and easy-to-hard suffix initialization, yielding I-GCG with ~100% ASR on AdvBench across four LLMs.
Problem
Optimization-based jailbreaks such as GCG are inefficient and weak: the single "Sure" target template gives suffixes that do not lead to harmful content, and single-token updates converge slowly.
Approach
Augment the GCG target with harmful self-suggestion/guidance (e.g., "my output is harmful"), update multiple suffix tokens per step by combining top single-token candidates, and initialize suffixes from a suffix optimized on an easy request.
Key results
- I-GCG reaches 100% ASR on Vicuna-7B-1.5, Guanaco-7B, Llama-2-7B-Chat and Mistral-7B-Instruct-0.2 on AdvBench, versus 54% for GCG and 56% for MAC on Llama-2-7B-Chat.
- Ablation on Llama-2-7B-Chat: full I-GCG reaches 100% ASR with 55 average iterations, versus 54% ASR and 510 iterations for the GCG baseline.
- On the NeurIPS 2023 Red Teaming Track, I-GCG achieves approximately 100% ASR versus 0.1-0.2% for ZeroShot, GBDA and PEZ.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use harmful guidance in the optimization target (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | ASR: 54% -> 82% | Helped |
| Use harmful guidance in the optimization target (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | Average iterations: 510 -> 955 | Hurt |
| Use automatic multi-coordinate updating (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | ASR: 54% -> 72% | Helped |
| Use automatic multi-coordinate updating (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | Average iterations: 510 -> 418 | Helped |
| Use easy-to-hard suffix initialization (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | ASR: 54% -> 68% | Helped |
| Use easy-to-hard suffix initialization (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | Average iterations: 510 -> 64 | Helped |
| Use all three techniques together (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | ASR: 54% -> 100% | Helped |
| Use all three techniques together (ablation) | GCG · AdvBench (LLAMA2-7B-CHAT) | Average iterations: 510 -> 55 | Helped |
| Replace the default harmful guidance with the listed alternative guidance templates (ablation) | I-GCG · AdvBench (LLAMA2-7B-CHAT) | ASR: 100% | No clear effect |
| Use I-GCG instead of MAC | VICUNA-7B-1.5 · AdvBench | ASR: 100% vs 100% | No clear effect |
| Use I-GCG instead of MAC | GUANACO-7B · AdvBench | ASR: 100% vs 100% | No clear effect |
| Use I-GCG instead of MAC | LLAMA2-7B-CHAT · AdvBench | ASR: 56% -> 100% | Helped |
Surprising findings
- Harmful guidance alone raises ASR the most but also increases average iterations (955 vs 510 for GCG), so it trades efficiency for effectiveness.
- Using various harmful guidance phrases (e.g., 'my action is unsafe') all reach nearly 100% ASR on Llama-2-7B-Chat.
Limitations
- Transferability to closed models remains low (e.g., 4% on ChatGPT-4), which the authors acknowledge.
- Harmful guidance design and general suffix initialization are left for future exploration.
- Evaluation relies on a template check plus ChatGPT-3.5 judge with manual review; no detailed human agreement is reported.
Experimental setup
Datasets: AdvBench harmful behaviors HarmBench NeurIPS 2023 Red Teaming Track
Benchmarks: AdvBench NeurIPS 2023 Red Teaming Track
Metrics: attack success rate average iterations
Baselines: GCG MAC AutoDAN Probe-Sampling AmpleGCG AdvPrompter PAIR TAP ZeroShot GBDA PEZ
Builds on: GCG AdvBench HarmBench
Closest papers by meaning
- Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models (NeurIPS 2026 · similarity 0.92)
- Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization (NeurIPS 2024 · similarity 0.92)
- An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.91)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.90)
- Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · similarity 0.90)
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.