Research map / Large language models / Language, safety and interpretability

Investigating the Security Threat Arising from “Yes-No” Implicit Bias in Large Language Models

AAAI 2025 · Large language models › Language, safety and interpretability · approach: Jailbreak elicitation and risk · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

The paper identifies a "Yes-No" implicit bias in LLMs by scoring instruction-level tendencies toward Yes vs No responses, then builds IB-ICM, a jailbreak that splices yes-biased benign instructions around a malicious one.

Problem

LLMs have implicit biases beyond social categories, and it is unclear whether a tendency to answer "Yes" can be exploited to flip refusals to harmful compliance in jailbreak settings.

Approach

Measure each instruction's inherent Yes/No response tendency via normalized probabilities of constructed Yes and No responses, then splice top-ranked yes-biased benign instructions around a malicious instruction as in-context manipulation, producing a semantically coherent, low-perplexity jailbreak.

Key results

• IB-ICM universal ranking achieves average GPT-judged ASR of 59.00% and KWM ASR of 73.25% across four main LLMs, versus 64.00% / 43.00% for GCG individual suffix.
• IB-ICM keeps prompt perplexity around 13-43 (GPT-2) while GCG prompts reach up to roughly 12,000 on ChatGLM2-6B.
• On five unseen LLMs, IB-ICM universal achieves 29% GPT-judged ASR on Qwen-7B and 25% on Llama3-8B, comparable to Evil and Comp. baselines.

Measured effects reported in the paper

Surprising findings

• Splicing random benign instructions alone can also produce harmful outputs, attributed to attention dispersal.
• Executing the yes-biased instructions in a pipeline (multi-round) rather than in parallel significantly reduces attack performance.

Limitations

• Attack success on some models (e.g., Llama2-7B, Qwen-7B mixed) is inconsistent and depends on hyperparameters and model.
• Measurement uses a small set of constructed Yes/No responses and limited models for the bias analysis.
• Brief responses occur in some cases, requiring a follow-up question to elicit detail.

Experimental setup

Datasets: Alpaca instructions (30,000 collected for bias measurement) AdvBench (100 malicious instructions)

Benchmarks: AdvBench

Metrics: Attack Success Rate (keyword matching) Attack Success Rate (GPT-4 judged) GPT-2 perplexity of prompts and responses

Baselines: Evil Comp. GCG (individual suffix) GCG (universal suffix)

Builds on: GCG In-Context Learning Comp. and Evil jailbreak prompts (Wei et al. 2024)

Closest papers by meaning

• Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks (ICLR 2025 · similarity 0.85)
• Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs (ICML 2025 · similarity 0.83)
• Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning (ICML 2025 · similarity 0.83)
• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.83)
• PoisonBench: Assessing Language Model Vulnerability to Poisoned Preference Data (ICML 2025 · similarity 0.83)
• Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.83)