{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/drattack-prompt-decomposition-and","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","arxiv_id":"2402.16914","date":"2024-02-25","proceeding":null,"authors":["Xirui Li","Ruochen Wang","Minhao Cheng","Tianyi Zhou","Cho-Jui Hsieh"],"abstract":"The safety alignment of Large Language Models (LLMs) is vulnerable to both manual and automated jailbreak attacks, which adversarially trigger LLMs to output harmful content. However, current methods for jailbreaking LLMs, which nest entire harmful prompts, are not effective at concealing malicious intent and can be easily identified and rejected by well-aligned LLMs. This paper discovers that decomposing a malicious prompt into separated sub-prompts can effectively obscure its underlying malicious intent by presenting it in a fragmented, less detectable form, thereby addressing these limitations. We introduce an automatic prompt \\textbf{D}ecomposition and \\textbf{R}econstruction framework for jailbreak \\textbf{Attack} (DrAttack). DrAttack includes three key components: (a) `Decomposition' of the original prompt into sub-prompts, (b) `Reconstruction' of these sub-prompts implicitly by in-context learning with semantically similar but harmless reassembling demo, and (c) a `Synonym Search' of sub-prompts, aiming to find sub-prompts' synonyms that maintain the original intent while jailbreaking LLMs. An extensive empirical study across multiple open-source and closed-source LLMs demonstrates that, with a significantly reduced number of queries, DrAttack obtains a substantial gain of success rate over prior SOTA prompt-only attackers. Notably, the success rate of 78.0\\% on GPT-4 with merely 15 queries surpassed previous art by 33.1\\%. The project is available at https://github.com/xirui-li/DrAttack.","url_abs":"https://arxiv.org/abs/2402.16914v3","url_pdf":"https://arxiv.org/pdf/2402.16914v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"drattack-prompt-decomposition-and","repo_url":"https://github.com/xirui-li/drattack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"in-context-learning","task_name":"In-Context Learning"},{"task_slug":"safety-alignment","task_name":"Safety Alignment"}],"methods":[{"method_slug":"absolute-position-encodings","method_name":"Absolute Position Encodings"},{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"bpe","method_name":"BPE"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"gpt-4","method_name":"GPT-4"},{"method_slug":"label-smoothing","method_name":"Label Smoothing"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"nest","method_name":"NesT"},{"method_slug":"position-wise-feed-forward-layer","method_name":"Position-Wise Feed-Forward Layer"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"transformer","method_name":"Transformer"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2402.16914","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.16914"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xirui-li/drattack","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":4,"unverified":3},"by_repo_kind":{"official":{"samples":7,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"9e255e603e115bb7","entry":"get_goals_and_targets","repo":"xirui-li/drattack","repo_kind":"official","path":"drattack/utils/data.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/drattack/utils/data.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9e255e603e115bb7"}},{"code_sha256_prefix":"f293af98d59df4d0","entry":"load_tokenizer","repo":"xirui-li/drattack","repo_kind":"official","path":"attack_prompt_data/uncensored_vicuna/uncensor.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/attack_prompt_data/uncensored_vicuna/uncensor.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f293af98d59df4d0"}},{"code_sha256_prefix":"814a87fca12a52fe","entry":"predict","repo":"xirui-li/drattack","repo_kind":"official","path":"attack_prompt_data/uncensored_vicuna/uncensor.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/attack_prompt_data/uncensored_vicuna/uncensor.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"814a87fca12a52fe"}},{"code_sha256_prefix":"b3ed9e01abd44cad","entry":"prompts_csv_to_list","repo":"xirui-li/drattack","repo_kind":"official","path":"gpt_automation/gpt_generate_content.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/gpt_automation/gpt_generate_content.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b3ed9e01abd44cad"}},{"code_sha256_prefix":"f5f35c29b3798704","entry":"evaluate","repo":"xirui-li/drattack","repo_kind":"official","path":"experiments/evaluate_with_GPT.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/experiments/evaluate_with_GPT.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f5f35c29b3798704"}},{"code_sha256_prefix":"ecaedd84a2db26ff","entry":"get_chatgpt_response","repo":"xirui-li/drattack","repo_kind":"official","path":"experiments/evaluate_with_GPT.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/experiments/evaluate_with_GPT.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ecaedd84a2db26ff"}},{"code_sha256_prefix":"25f2fc9122340697","entry":"load_model","repo":"xirui-li/drattack","repo_kind":"official","path":"attack_prompt_data/uncensored_vicuna/uncensor.py","file_url":"https://github.com/xirui-li/drattack/blob/HEAD/attack_prompt_data/uncensored_vicuna/uncensor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"25f2fc9122340697"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}