{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/comprehensive-assessment-of-jailbreak-attacks","title":"JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs","arxiv_id":"2402.05668","date":"2024-02-08","proceeding":null,"authors":["Junjie Chu","Yugeng Liu","Ziqing Yang","Xinyue Shen","Michael Backes","Yang Zhang"],"abstract":"Jailbreak attacks aim to bypass the LLMs' safeguards. While researchers have proposed different jailbreak attacks in depth, they have done so in isolation -- either with unaligned settings or comparing a limited range of methods. To fill this gap, we present a large-scale evaluation of various jailbreak attacks. We collect 17 representative jailbreak attacks, summarize their features, and establish a novel jailbreak attack taxonomy. Then we conduct comprehensive measurement and ablation studies across nine aligned LLMs on 160 forbidden questions from 16 violation categories. Also, we test jailbreak attacks under eight advanced defenses. Based on our taxonomy and experiments, we identify some important patterns, such as heuristic-based attacks could achieve high attack success rates but are easy to mitigate by defenses, causing low practicality. Our study offers valuable insights for future research on jailbreak attacks and defenses. We hope our work could help the community avoid incremental work and serve as an effective benchmark tool for practitioners.","url_abs":"https://arxiv.org/abs/2402.05668v3","url_pdf":"https://arxiv.org/pdf/2402.05668v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"comprehensive-assessment-of-jailbreak-attacks","repo_url":"https://github.com/TrustAIRLab/Comprehensive_Jailbreak_Assessment","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"comprehensive-assessment-of-jailbreak-attacks","repo_url":"https://github.com/Junjie-Chu/CJA_Comprehensive_Jailbreak_Assessment","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}}],"tasks":[{"task_slug":"ethics","task_name":"Ethics"}],"methods":[{"method_slug":"align","method_name":"ALIGN"},{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"attention-dropout","method_name":"Attention Dropout"},{"method_slug":"bpe","method_name":"BPE"},{"method_slug":"cosine-annealing","method_name":"Cosine Annealing"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"gpt-3","method_name":"GPT-3"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"linear-warmup-with-cosine-annealing","method_name":"Linear Warmup With Cosine Annealing"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"weight-decay","method_name":"Weight Decay"}],"datasets_introduced":[{"slug":"fq-160","name":"FQ-160","full_name":"Forbidden Question Dataset (160)"},{"slug":"forbidden-questions-160","name":"Forbidden_Questions_160","full_name":""},{"slug":"forbidden-questions-cja","name":"Forbidden_Questions_CJA","full_name":"Forbidden Question Dataset (160)"}],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2402.05668","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.05668"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Junjie-Chu/CJA_Comprehensive_Jailbreak_Assessment","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/TrustAIRLab/Comprehensive_Jailbreak_Assessment","reach":{"status":"ok"}}],"summary":{"ran_violates":1,"unverified":1},"by_repo_kind":{"official":{"samples":2,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":2,"samples":[{"code_sha256_prefix":"7c508037b40522af","entry":"str2bool","repo":"TrustAIRLab/Comprehensive_Jailbreak_Assessment","repo_kind":"official","path":"scripts_label/label.py","file_url":"https://github.com/TrustAIRLab/Comprehensive_Jailbreak_Assessment/blob/HEAD/scripts_label/label.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7c508037b40522af"}},{"code_sha256_prefix":"51dbd68f4d5aba9e","entry":"num_tokens_from_string","repo":"TrustAIRLab/Comprehensive_Jailbreak_Assessment","repo_kind":"official","path":"scripts_label/label.py","file_url":"https://github.com/TrustAIRLab/Comprehensive_Jailbreak_Assessment/blob/HEAD/scripts_label/label.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"51dbd68f4d5aba9e"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}