{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/bag-of-tricks-benchmarking-of-jailbreak","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","arxiv_id":"2406.09324","date":"2024-06-13","proceeding":null,"authors":["Zhao Xu","Fan Liu","Hao liu"],"abstract":"Although Large Language Models (LLMs) have demonstrated significant capabilities in executing complex tasks in a zero-shot manner, they are susceptible to jailbreak attacks and can be manipulated to produce harmful outputs. Recently, a growing body of research has categorized jailbreak attacks into token-level and prompt-level attacks. However, previous work primarily overlooks the diverse key factors of jailbreak attacks, with most studies concentrating on LLM vulnerabilities and lacking exploration of defense-enhanced LLMs. To address these issues, we introduced $\\textbf{JailTrickBench}$ to evaluate the impact of various attack settings on LLM performance and provide a baseline for jailbreak attacks, encouraging the adoption of a standardized evaluation framework. Specifically, we evaluate the eight key factors of implementing jailbreak attacks on LLMs from both target-level and attack-level perspectives. We further conduct seven representative jailbreak attacks on six defense methods across two widely used datasets, encompassing approximately 354 experiments with about 55,000 GPU hours on A800-80G. Our experimental results highlight the need for standardized benchmarking to evaluate these attacks on defense-enhanced LLMs. Our code is available at https://github.com/usail-hkust/JailTrickBench.","url_abs":"https://arxiv.org/abs/2406.09324v3","url_pdf":"https://arxiv.org/pdf/2406.09324v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"bag-of-tricks-benchmarking-of-jailbreak","repo_url":"https://github.com/usail-hkust/bag_of_tricks_for_llm_jailbreaking","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"bag-of-tricks-benchmarking-of-jailbreak","repo_url":"https://github.com/usail-hkust/jailtrickbench","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"benchmarking","task_name":"Benchmarking"},{"task_slug":null,"task_name":"GPU"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2406.09324","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2406.09324"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/usail-hkust/JailTrickBench","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/usail-hkust/jailtrickbench","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/usail-hkust/bag_of_tricks_for_llm_jailbreaking","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":10,"unverified":1},"by_repo_kind":{"official":{"samples":11,"ran":10,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"bc744b10851b8303","entry":"extract_keywords_and_numbers","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"GPTEvaluatorAgent/common.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/GPTEvaluatorAgent/common.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bc744b10851b8303"}},{"code_sha256_prefix":"5a305b2685e3db88","entry":"filter_Null","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"analysis/report_trick.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/analysis/report_trick.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5a305b2685e3db88"}},{"code_sha256_prefix":"2a1d9def76e4e4ab","entry":"get_evident_judge_system_prompt","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"GPTEvaluatorAgent/system_prompts.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/GPTEvaluatorAgent/system_prompts.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2a1d9def76e4e4ab"}},{"code_sha256_prefix":"9fdfb4537f5fd761","entry":"process_target_response","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"GPTEvaluatorAgent/common.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/GPTEvaluatorAgent/common.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9fdfb4537f5fd761"}},{"code_sha256_prefix":"fee5b8c91309a053","entry":"random_insert_updated","repo":"usail-hkust/bag_of_tricks_for_llm_jailbreaking","repo_kind":"official","path":"llm_smooth/smoothLLM.py","file_url":"https://github.com/usail-hkust/bag_of_tricks_for_llm_jailbreaking/blob/HEAD/llm_smooth/smoothLLM.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fee5b8c91309a053"}},{"code_sha256_prefix":"49585f317c841af4","entry":"random_patch","repo":"usail-hkust/bag_of_tricks_for_llm_jailbreaking","repo_kind":"official","path":"llm_smooth/smoothLLM.py","file_url":"https://github.com/usail-hkust/bag_of_tricks_for_llm_jailbreaking/blob/HEAD/llm_smooth/smoothLLM.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"49585f317c841af4"}},{"code_sha256_prefix":"3d48c8f02186ce29","entry":"random_swap_updated","repo":"usail-hkust/bag_of_tricks_for_llm_jailbreaking","repo_kind":"official","path":"llm_smooth/smoothLLM.py","file_url":"https://github.com/usail-hkust/bag_of_tricks_for_llm_jailbreaking/blob/HEAD/llm_smooth/smoothLLM.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3d48c8f02186ce29"}},{"code_sha256_prefix":"db66e64c1a095a76","entry":"remove_code_blocks","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"GPTEvaluatorAgent/language_models.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/GPTEvaluatorAgent/language_models.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"db66e64c1a095a76"}},{"code_sha256_prefix":"dd40eb4d6e7fc975","entry":"short_str","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"analysis/report_trick.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/analysis/report_trick.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dd40eb4d6e7fc975"}},{"code_sha256_prefix":"67ddc38b3c00c1de","entry":"smooth_pert","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"defense.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/defense.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"67ddc38b3c00c1de"}},{"code_sha256_prefix":"10631d69a34d5165","entry":"generate_defense_goal","repo":"usail-hkust/JailTrickBench","repo_kind":"official","path":"defense.py","file_url":"https://github.com/usail-hkust/JailTrickBench/blob/HEAD/defense.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"10631d69a34d5165"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}