Research map / Large language models / Language, safety and interpretability
Functional Homotopy: Smoothing Discrete Optimization via Continuous Parameters for LLM Jailbreak Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes functional homotopy, which fine-tunes LLMs to produce a chain of progressively less-aligned checkpoints and warm-starts a greedy token-level jailbreak search along that chain, improving attack success on Llama-2 and Llama-3.
Problem
Gradient-based token search for LLM jailbreak suffixes is hard because the input space is discrete and token gradients give only weak guidance; the paper also argues the general input generation problem is NP-hard.
Approach
Lift the objective to F(p,x) with model parameters p as a continuous variable; run gradient descent on p to create a chain of intermediate (weakly aligned) checkpoints, then solve the discrete input search from the weakest checkpoint back to the base model, warm-starting each stage with the previous suffix (homotopy/easy-to-hard).
Key results
- FH-GR reaches 99.5% ASR on Llama-2 7B at 1000 iterations versus 63.5% for GCG and 37.5% for GR.
- On Llama-3 8B Instruct at 1000 iterations FH-GR achieves 76.5% ASR versus 59.0% for GCG.
- Token gradient rankings have RBO of about 0.50-0.52 against ground truth, barely above random ranking (0.50).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply functional homotopy to GR (ablation) | GR · AdvBench + HarmBench, Llama-2 | ASR: 37.5 → 99.5 | Helped |
| apply functional homotopy to GCG (ablation) | GCG · AdvBench + HarmBench, Llama-2 | ASR: 69.5 → 99.0 | Helped |
| apply functional homotopy to AutoDAN (ablation) | AutoDAN · AdvBench + HarmBench, Llama-2 | ASR: 61.5 → 68.5 | Helped |
| apply functional homotopy to GR (ablation) | GR · AdvBench + HarmBench, Llama-3 | ASR: 47.0 → 76.5 | Helped |
| apply functional homotopy to GCG (ablation) | GCG · AdvBench + HarmBench, Llama-3 | ASR: 59.0 → 77.5 | Helped |
| apply functional homotopy to AutoDAN (ablation) | AutoDAN · AdvBench + HarmBench, Llama-3 | ASR: 19.5 → 14.5 | Hurt |
| use token-gradient ranking instead of random ranking | token selection · AdvBench, Llama-3 8B | RBO: 0.50 → 0.517 | Helped |
| use token-gradient ranking instead of random ranking | token selection · AdvBench, Llama-2 7B | RBO: 0.50 → 0.506 | Helped |
| use token-gradient ranking instead of random ranking | token selection · AdvBench, Mistral-v0.3 | RBO: 0.498 → 0.503 | Helped |
| use token-gradient ranking instead of random ranking | token selection · AdvBench, Vicuna-v1.5 | RBO: 0.50 → 0.507 | Helped |
| use token-gradient substitutions instead of greedy random substitutions | GCG · jailbreak search iteration | computational time: +85% computational time | Hurt |
| use functional homotopy rather than direct search | FH-GR · Llama-2 and Llama-3, hard samples | loss convergence | Helped |
Surprising findings
- Token gradient ranking is nearly uninformative (RBO ~0.5) for jailbreak token substitution, marginally better than random.
- Attacks found on intermediate de-aligned checkpoints do not reliably transfer to the base Llama-2 and Llama-3 checkpoints, while Vicuna transfers well.
Limitations
- Gradient-based token ranking evidence is limited to 20 samples and four positions.
- Fine-tuning on the affirmative-prefix loss caused overfitting, and the paper uses a judge-based success criterion that may not match the loss.
- AutoDAN performance drops on Llama-3 with homotopy, and the approach shows mixed results across models.
Experimental setup
Datasets: AdvBench HarmBench
Benchmarks: AdvBench HarmBench
Metrics: attack success rate rank biased overlap iterations to success runtime
Baselines: GCG AutoDAN Greedy Random (GR)
Builds on: GCG AutoDAN homotopy method LoRA
Closest papers by meaning
- Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes (NeurIPS 2024 · similarity 0.87)
- MMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Vision Language Models (AAAI 2025 · similarity 0.86)
- Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization (NeurIPS 2024 · similarity 0.86)
- Improved Techniques for Optimization-Based Jailbreaking on Large Language Models (ICLR 2025 · similarity 0.86)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.85)
- Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.