{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/advancing-adversarial-suffix-transfer","title":"Advancing Adversarial Suffix Transfer Learning on Aligned Large Language Models","arxiv_id":"2408.14866","date":"2024-08-27","proceeding":null,"authors":["Hongfu Liu","Yuxi Xie","Ye Wang","Michael Shieh"],"abstract":"Language Language Models (LLMs) face safety concerns due to potential misuse by malicious users. Recent red-teaming efforts have identified adversarial suffixes capable of jailbreaking LLMs using the gradient-based search algorithm Greedy Coordinate Gradient (GCG). However, GCG struggles with computational inefficiency, limiting further investigations regarding suffix transferability and scalability across models and data. In this work, we bridge the connection between search efficiency and suffix transferability. We propose a two-stage transfer learning framework, DeGCG, which decouples the search process into behavior-agnostic pre-searching and behavior-relevant post-searching. Specifically, we employ direct first target token optimization in pre-searching to facilitate the search process. We apply our approach to cross-model, cross-data, and self-transfer scenarios. Furthermore, we introduce an interleaved variant of our approach, i-DeGCG, which iteratively leverages self-transferability to accelerate the search process. Experiments on HarmBench demonstrate the efficiency of our approach across various models and domains. Notably, our i-DeGCG outperforms the baseline on Llama2-chat-7b with ASRs of $43.9$ ($+22.2$) and $39.0$ ($+19.5$) on valid and test sets, respectively. Further analysis on cross-model transfer indicates the pivotal role of first target token optimization in leveraging suffix transferability for efficient searching.","url_abs":"https://arxiv.org/abs/2408.14866v2","url_pdf":"https://arxiv.org/pdf/2408.14866v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"advancing-adversarial-suffix-transfer","repo_url":"https://github.com/Waffle-Liu/DeGCG","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"red-teaming","task_name":"Red Teaming"},{"task_slug":"transfer-learning","task_name":"Transfer Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2408.14866","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2408.14866"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Waffle-Liu/DeGCG","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":4,"unverified":3},"by_repo_kind":{"official":{"samples":7,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6fa90dd36057918e","entry":"expand_experiment_configs","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"eval_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/eval_utils.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6fa90dd36057918e"}},{"code_sha256_prefix":"400ada600d105b0a","entry":"get_nonascii_toks","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"baselines/gcg/gcg_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/baselines/gcg/gcg_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"400ada600d105b0a"}},{"code_sha256_prefix":"914cce1bc1e0a0d8","entry":"parse_indexing_expression","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"eval_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/eval_utils.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"914cce1bc1e0a0d8"}},{"code_sha256_prefix":"0393dcd85dc803dd","entry":"replace_model_parameters","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"eval_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/eval_utils.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0393dcd85dc803dd"}},{"code_sha256_prefix":"d073e342e38af354","entry":"check_refusal_completions","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"baselines/check_refusal_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/baselines/check_refusal_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d073e342e38af354"}},{"code_sha256_prefix":"5949ab432e811362","entry":"load_model_and_tokenizer","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"baselines/model_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/baselines/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5949ab432e811362"}},{"code_sha256_prefix":"112080cc850b86b9","entry":"sample_control","repo":"Waffle-Liu/DeGCG","repo_kind":"official","path":"baselines/gcg/gcg_utils.py","file_url":"https://github.com/Waffle-Liu/DeGCG/blob/HEAD/baselines/gcg/gcg_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"112080cc850b86b9"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}