Research map / Large language models / Language, safety and interpretability

TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: Controlled text generation · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces TROPT, an open modular framework unifying discrete text-trigger optimizers (models, losses, optimizers) into runnable recipes, and uses it for a head-to-head optimizer benchmark, a jailbreak-enhancement ablation, and cross-domain ports.

Problem

Discrete text-trigger optimizers are scattered across domain-specific codebases with proliferating variants, making them hard to adopt, adapt across domains, and compare head-to-head.

Approach

A single modular interface where any model backend, loss, and optimizer compose into recipes; optimizers are standalone self-contained modules, enabling controlled comparisons by fixing all but one component.

Key results

• In a head-to-head benchmark of 14 optimizers across four models, PAL (~3/14) and MAC (~3.5/14) outperform the GCG baseline (~5/14) in mean rank, while RAL (black-box) reaches ~5/14.
• Replacing the canonical affirmative target with a jailbroken model's response roughly doubles median universality over the Base recipe in the jailbreak enhancement study.
• TROPT's GCG reproduces NanoGCG's final loss (0.597 vs 0.633) while running ~2.5x faster (~60 vs ~149 minutes on average over 500 steps).

Surprising findings

• The handcrafted jailbreak template yields the highest universality, but the authors find its success stems mainly from the template rather than the optimization.
• Black-box RAL, which replaces the gradient with random tensors, matches white-box GCG in mean rank.

Limitations

• Scope limited to discrete search optimizers; RL-trained investigator LLMs and agentic approaches are excluded.
• Optimizer comparison focuses on the jailbreak domain with a single loss-minimization metric rather than downstream attack success.
• Cross-domain benchmark deferred to future work; optimizer potency may vary with model and domain.

Experimental setup

Datasets: ClearHarm

Benchmarks: ClearHarm StrongReject

Metrics: mean rank final loss universality (jailbreak success) attack success in top-10 retrieval evasion rate runtime

Baselines: GCG NanoGCG HotFlip GBDA PEZ BEAST AdvDecoding RAL MAC

Builds on: GCG HotFlip AutoPrompt PEZ BEAST PAL

Closest papers by meaning

• OptMATH: A Scalable Bidirectional Data Synthesis Framework for Optimization Modeling (ICML 2025 · similarity 0.87)
• Large Language Models to Enhance Bayesian Optimization (ICLR 2024 · similarity 0.85)
• Implicit Optimization Bias of Next-token Prediction in Linear Models (NeurIPS 2024 · similarity 0.85)
• BBOWP-Bench: Evaluating LLMs on Black-Box Optimization Word Problems (NeurIPS 2026 · similarity 0.85)
• MM-OptBench: A Solver-Grounded Benchmark for Multimodal Optimization Modeling (NeurIPS 2026 · similarity 0.85)
• metaTextGrad: Automatically optimizing language model optimizers (NeurIPS 2025 · similarity 0.85)