Research map / Adversarial robustness and security / Attacks on text and graphs

Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a FLOPs-based scaling-law framework for jailbreak attacks, fitting saturating exponentials to attack-success trajectories and comparing GCG, PAIR, BoN, and AutoDAN across Llama, Qwen3, and Gemma-3 models.

Problem

Jailbreak attacks differ in iteration definitions, so their success vs. attacker effort is incomparable; the paper asks how jailbreak success scales with compute across methods, model families, and harm types.

Approach

Treat each jailbreak as a compute-bounded optimization procedure measured on a shared FLOPs axis, fit a saturating exponential to FLOPs-ASR curves to derive comparable efficiency statistics (B50, B95), and use a same-state one-step comparison to explain why prompt-space rewriting (PAIR) beats gradient suffix search (GCG).

Key results

• On Llama-3.1-8B-Instruct, PAIR reaches a red-team score ceiling of 9.80 with B95 of 6012 TFLOPs versus GCG's ceiling of 5.16 and B95 of 13923 TFLOPs.
• Under PAIR, asymptotic ceilings are tightly clustered across Qwen3 sizes (9.80-9.95), while Llama-3.2-3B plateaus at 7.26 with B50 of 4303 TFLOPs.
• A goal-matched PAIR variant still reaches a ceiling of 8.60 versus 5.16 for GCG, suggesting the efficiency gap is not solely due to objective mismatch.

Surprising findings

• Under the relevance score, BoN overtakes PAIR in ceiling (5.38 vs 3.86), reversing the ranking seen under the red-team score.
• Llama-3.2-3B-Instruct under PAIR has a B95 beyond the evaluated budget window, so it does not approach its plateau within evaluated compute.

Limitations

• FLOPs normalization is an approximation that ignores latency, rate limits, and defender monitoring costs.
• Results depend on GPT-5 judge and rubric; no human-audited subset is reported.
• Evaluation limited to 200 English prompt-only goals, four attacks, and a small set of models.

Experimental setup

Datasets: AdvBench HarmBench ClearHarm

Benchmarks: AdvBench HarmBench ClearHarm

Metrics: red-team score (ASR) relevance score GPT-2 perplexity stealth score B50 B95 R^2

Baselines: GCG BoN AutoDAN GCG(orig)

Builds on: GCG PAIR AutoDAN best-of-n jailbreaking

Closest papers by meaning

• MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks (NeurIPS 2026 · similarity 0.93)
• JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.92)
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.92)
• Improved Techniques for Optimization-Based Jailbreaking on Large Language Models (ICLR 2025 · similarity 0.92)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.91)
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.91)