Research map / Adversarial robustness and security / Attacks on text and graphs
Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that leading safety-aligned LLMs (Llama-2/3, Gemma, GPT-3.5/4o, Claude, R2D2) are not robust to simple adaptive attacks combining a manual prompt template, logprob-guided random search, self-transfer, and prefilling, reaching 100% ASR under a GPT-4 judge.
Problem
Existing jailbreak evaluations use static attacks that substantially underestimate the vulnerability of frontier safety-aligned LLMs; robustness evaluations need adaptive attacks tailored to each model's defenses and API access.
Approach
Combine a manually designed rule-based prompt template with random search on an adversarial suffix maximizing the logprob of an affirmative target token, initialized via self-transfer from easier requests, and customize attacks per model (in-context prompts for R2D2, prefilling for Claude, transfer for Claude 3 Opus/others) rather than per request.
Key results
- Achieves 100% attack success rate under the GPT-4 judge on Llama-2-Chat-7B/13B/70B, Llama-3-Instruct-8B, Gemma-7B, GPT-3.5 Turbo, GPT-4o, R2D2 and all tested Claude models, versus prior best of 92% (PAP) on Llama-2-Chat-7B.
- Prefilling attack reaches 100% ASR on Claude 2.0 with up to 10 restarts, versus prior best 61%.
- Random search on restricted trojan token candidates achieves total reward-model score -30.22, best overall in the SaTML'24 Trojan Detection Competition (ground truth -37.48).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add random search and self-transfer to the prompt attack (ablation) | Llama-2-Chat-7B · AdvBench | attack success rate: 0% -> 100% | Helped |
| Add self-transfer to prompt plus random search (ablation) | Llama-2-Chat-7B · AdvBench | attack success rate: 50% -> 100% | Helped |
| Add self-transfer to prompt plus random search (ablation) | Gemma-7B · AdvBench | attack success rate: 84% -> 100% | Helped |
| Add random search to the in-context prompt (ablation) | R2D2-7B · HarmBench | attack success rate: 90% -> 100% | Helped |
| Use a model-customized prompt rather than the default prompt (ablation) | GPT-4o · AdvBench | attack success rate: 0% -> 72% | Helped |
| Add random search and self-transfer to the custom prompt (ablation) | GPT-4o · AdvBench | attack success rate: 72% -> 100% | Helped |
| Use prefilling rather than transfer from GPT-4 (ablation) | Claude 3 Opus · AdvBench | attack success rate: 0% -> 100% | Helped |
| Use a 25-token adversarial suffix rather than other tested lengths (ablation) | Gemma-7B random search · AdvBench | attack success rate | Helped |
| Search only tokens containing Latin characters rather than the whole vocabulary (ablation) | Random search jailbreak attack · AdvBench | attack success rate | Hurt |
| Use random search on restricted candidate tokens | Trojan detection · Trojan competition held-out test set | reward-model score: -30.22 vs -29.21 | Mixed |
Surprising findings
- Static prompt template alone gives 0% on Llama-2-Chat, while the in-context prompt gives 90% on R2D2 and random search lifts it to 100%.
- Non-determinism of GPT API log-probabilities even at temperature zero with fixed seed hampers random search.
Limitations
- GPT-4 judge can produce false positives, notably on Claude 2.1 (around 20%), and a 10/10 score does not guarantee harmful content is useful.
- Attacks are model-specific and tuned per model; no single method works across all targets.
- SmoothLLM test-time defense not bypassed by the static attack combination.
Experimental setup
Datasets: AdvBench (50 behaviors curated by HarmBench) SaTML 2024 Trojan Detection Competition data
Benchmarks: AdvBench 50-behavior subset (HarmBench curation) SaTML 2024 Trojan Detection Competition
Metrics: attack success rate jailbreak score (1-10, success at 10/10) reward model score (trojan)
Baselines: GCG PAIR TAP Persuasive Adversarial Prompts Persona Modulation Foot-in-the-Door attack
Builds on: random search adversarial attacks on vision models GCG PAIR TAP PAP
Closest papers by meaning
- One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.90)
- Lifelong Safety Alignment for Language Models (NeurIPS 2025 · similarity 0.90)
- Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization (NeurIPS 2024 · similarity 0.90)
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.89)
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · similarity 0.89)
- Injecting Universal Jailbreak Backdoors into LLMs in Minutes (ICLR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.