Research map / Adversarial robustness and security / Attacks on text and graphs

One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs

ICLR 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ArrAttack, a rewriting-based jailbreak framework that trains a robustness judgment model on SmoothLLM-defended outcomes and fine-tunes Llama2-7b generators to produce jailbreak prompts that survive defenses.

Problem

Existing jailbreak attacks ignore modern defenses (defensive suffixes, perturbation, paraphrasing, decoding defenses), so they lose effectiveness against defended LLMs.

Approach

Label rewriting-based jailbreak prompts by their robustness under SmoothLLM perturbation, train a universal robustness judgment model on these labels, and use the labeled robust prompts to fine-tune a Llama2-7b generator that produces robust jailbreak prompts in a single inference.

Key results

• Under six defenses (reported in four in Table) on Llama2-7b-chat, Vicuna-7b, and Guanaco-7b, ArrAttack averages 57.69% ASR across 18 scenarios versus 34.03% for the best baseline AutoDAN-HGA (GPTFuzz evaluation).
• On plain Llama2-7b-chat, ArrAttack reaches 93.87% ASR (GPTFuzz) with PPL 63.64, lower than the original malicious queries.
• Transferred prompts from Llama2-7b-chat reach 84% on Vicuna-13b, 74% on GPT-4, and 40% on Claude-3, where baselines get 0-8% on Claude-3.

Measured effects reported in the paper

Surprising findings

• The robustness judgment model trained only on SmoothLLM-defended Llama2-7b-chat data transfers to other defenses and models, improving ASR under unseen defenses.
• AmpleGCG achieves near-zero transfer to GPT-4 and Claude-3 despite strong plain-model performance.

Limitations

• Robustness labels come only from SmoothLLM, a single defense, used to build training data.
• Attack attempts required are large for Llama2-7b-chat (up to 200), and the method relies on GPTFuzz/GPT-4 judges that may be imperfect.
• Ablation and average results mix evaluation settings; some reported numbers have inconsistencies (e.g., averages across six defenses versus four shown).

Experimental setup

Datasets: AdvBench HarmBench JBB-Behaviors

Benchmarks: AdvBench HarmBench JBB-Behaviors

Metrics: attack success rate semantic similarity perplexity

Baselines: AmpleGCG AutoDAN-GA AutoDAN-HGA ReNeLLM Prompt-only

Builds on: SmoothLLM GPTFuzz AutoDAN AmpleGCG ReNeLLM

Closest papers by meaning

• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.92)
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (ICLR 2024 · similarity 0.92)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.92)
• Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks (NeurIPS 2024 · similarity 0.92)
• Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · similarity 0.91)
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.91)