The paper introduces TACS, a trajectory‑aware candidate selection framework designed to improve jailbreak suffix optimization for large language models. Traditional gradient‑based methods choose candidates based solely on the lowest current loss, which the authors argue is myopic and can lead to reward hacking. TACS augments per‑step evaluation with a trajectory‑aware proxy, reference‑policy regularization, and a chi‑squared correction to encourage selections that remain effective beyond the immediate step. Experiments on HarmBench show that TACS consistently outperforms strong baselines, achieving higher attack success rates and more stable optimization behavior.
arXiv:2606. 11425v1 Announce Type: cross Abstract: Jailbreak attacks expose persistent safety weaknesses in large language models (LLMs), but existing stateless single-turn methods face a trade-off: hand-crafted prompts are expressive but static, while iterative prompt optimization can adapt but often relies on low-level mutations that require many target queries.
The paper introduces BOSS, a plug‑and‑play framework that enhances Greedy Coordinate Gradient (GCG) jailbreak attacks by employing a breadth‑oriented suffix search. BOSS incorporates Tail‑Focused Adversarial Loss, standard source loss, and behavior coverage to select terminal suffixes, then explores multiple short trajectories and selectively continues promising suffixes. Experiments on public benchmarks demonstrate that BOSS increases attack success rates across various GCG‑based methods while reducing optimization time.
The paper "Jailbreaking in the Haystack" introduces NINJA, a jailbreak technique that exploits long-context language models by appending benign, model-generated content to harmful user goals. It demonstrates that the position of harmful goals within the context is crucial for safety, and shows that NINJA significantly boosts attack success rates on models such as LLaMA, Qwen, Mistral, and Gemini. Unlike previous methods, NINJA is low-resource, transferable, less detectable, and compute‑optimal, revealing that carefully crafted benign long contexts can expose fundamental vulnerabilities in modern LMs.
AlcaTRAz is a prompt‑level defense that uses rule trees to insert controlled character‑level perturbations into input text, disrupting jailbreak attacks without modifying or retraining the target LLM. It operates solely on the input, making it suitable for black‑box deployments, and was evaluated on 33 open‑weight models and 22 jailbreak types, outperforming three baseline defenses in 73.4 % of model‑attack combinations. While it significantly reduces high‑severity jailbreak success, it does not eliminate it and is intended as one layer of a broader defense strategy.
arXiv:2606. 05609v1 Announce Type: cross Abstract: As large language models (LLMs) are widely deployed, identifying their vulnerability through jailbreak attacks becomes increasingly critical.
arXiv:2510. 02422v4 Announce Type: replace-cross Abstract: Existing gradient-based jailbreak attacks typically optimize a fixed-length adversarial suffix toward a predefined target response with a static optimization strategy.
The paper introduces a new metric, ASR_STEP, that extends the traditional attack success rate (ASR) by penalizing repeated calls to a victim large language model during jailbreak attempts. Experiments on JailBreakBench show that GCG’s scores drop by 7.0–8.7 percentage points after discounting, while PAP’s scores remain unchanged, and PAIR’s discount ranges from 3.4–12 percentage points depending on the iterative strategy. The authors argue that reporting both ASR and ASR_STEP makes the cost of repeated victim-model interactions explicit.
arXiv:2602. 05746v2 Announce Type: replace-cross Abstract: Prompt injection is a critical vulnerability in LLM agents, yet the strongest methods still rely on human red-teamers and hand-crafted prompts.
arXiv:2606. 04027v1 Announce Type: cross Abstract: Diffusion large language models (dLLMs) generate text by iteratively denoising partially masked sequences under bidirectional context, exposing a safety surface distinct from autoregressive LLMs.
arXiv:2606. 26936v1 Announce Type: cross Abstract: With a profusion of jailbreaks for LLMs now widely known, a growing concern is that non-expert malicious actors ("the average Jane") could elicit actionable responses to malicious requests.
arXiv:2506. 22666v3 Announce Type: replace-cross Abstract: The rise of API-only access to state-of-the-art LLMs highlights the need for effective black-box jailbreak methods to identify model vulnerabilities in real-world settings.
arXiv:2608. 15594v1 Announce Type: new Abstract: Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails.