Research map / Large language models / Language, safety and interpretability

h4rm3l: A Language for Composable Jailbreak Attack Synthesis

ICLR 2025 · Large language models › Language, safety and interpretability · approach: Jailbreak attacks and defenses

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Presents h4rm3l, a DSL-based toolkit and program-synthesis system that composes parameterized string transformations into jailbreak attacks, plus a released dataset of synthesized attacks and benchmark responses from six LLMs.

Problem

Existing LLM safety assessments rely on fixed templated jailbreak prompts and benchmarking pipelines, which fail to capture the composable, evolving nature of jailbreak attacks.

Approach

Express jailbreak attacks as compositions of parameterized string transformation primitives in a formal, human-readable DSL, and automatically synthesize new attacks optimized against a target LLM using a bandit-driven program synthesizer with LLM-estimated attack success.

Key results

• Released 15,891 synthesized jailbreak attacks; 2,656 have estimated ASR above 40% on their target LLM.
• Benchmark of 113 attacks on 50 AdvBench prompts across six target models yields 33,900 evaluated responses (5,650 per model).

Limitations

• Estimated ASR for synthesized attacks relies on a small number of illicit prompts (5) and an LLM-based classifier.
• Attacks are optimized against specific target models, so transfer across models is not established by this datasheet.

Experimental setup

Datasets: AdvBench

Benchmarks: AdvBench

Metrics: attack success rate (estimated ASR)

Baselines: SOTA jailbreak attacks (23 reference attacks)

Builds on: AdvBench

Closest papers by meaning

• Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions (ICML 2025 · similarity 0.92)
• One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.92)
• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.91)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.91)
• Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.91)
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (ICLR 2024 · similarity 0.91)