{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/jailbreaking-leading-safety-aligned-llms-with","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","arxiv_id":"2404.02151","date":"2024-04-02","proceeding":null,"authors":["Maksym Andriushchenko","Francesco Croce","Nicolas Flammarion"],"abstract":"We show that even the most recent safety-aligned LLMs are not robust to simple adaptive jailbreaking attacks. First, we demonstrate how to successfully leverage access to logprobs for jailbreaking: we initially design an adversarial prompt template (sometimes adapted to the target LLM), and then we apply random search on a suffix to maximize a target logprob (e.g., of the token \"Sure\"), potentially with multiple restarts. In this way, we achieve 100% attack success rate -- according to GPT-4 as a judge -- on Vicuna-13B, Mistral-7B, Phi-3-Mini, Nemotron-4-340B, Llama-2-Chat-7B/13B/70B, Llama-3-Instruct-8B, Gemma-7B, GPT-3.5, GPT-4o, and R2D2 from HarmBench that was adversarially trained against the GCG attack. We also show how to jailbreak all Claude models -- that do not expose logprobs -- via either a transfer or prefilling attack with a 100% success rate. In addition, we show how to use random search on a restricted set of tokens for finding trojan strings in poisoned models -- a task that shares many similarities with jailbreaking -- which is the algorithm that brought us the first place in the SaTML'24 Trojan Detection Competition. The common theme behind these attacks is that adaptivity is crucial: different models are vulnerable to different prompting templates (e.g., R2D2 is very sensitive to in-context learning prompts), some models have unique vulnerabilities based on their APIs (e.g., prefilling for Claude), and in some settings, it is crucial to restrict the token search space based on prior knowledge (e.g., for trojan detection). For reproducibility purposes, we provide the code, logs, and jailbreak artifacts in the JailbreakBench format at https://github.com/tml-epfl/llm-adaptive-attacks.","url_abs":"https://arxiv.org/abs/2404.02151v4","url_pdf":"https://arxiv.org/pdf/2404.02151v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"jailbreaking-leading-safety-aligned-llms-with","repo_url":"https://github.com/tml-epfl/llm-adaptive-attacks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"in-context-learning","task_name":"In-Context Learning"}],"methods":[{"method_slug":"absolute-position-encodings","method_name":"Absolute Position Encodings"},{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"attention-dropout","method_name":"Attention Dropout"},{"method_slug":"bpe","method_name":"BPE"},{"method_slug":"cosine-annealing","method_name":"Cosine Annealing"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"gpt-3","method_name":"GPT-3"},{"method_slug":"gpt-4","method_name":"GPT-4"},{"method_slug":"label-smoothing","method_name":"Label Smoothing"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"linear-warmup-with-cosine-annealing","method_name":"Linear Warmup With Cosine Annealing"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"position-wise-feed-forward-layer","method_name":"Position-Wise Feed-Forward Layer"},{"method_slug":"r2d2","method_name":"R2D2"},{"method_slug":"random-search","method_name":"Random Search"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"set","method_name":"SET"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"transformer","method_name":"Transformer"},{"method_slug":"weight-decay","method_name":"Weight Decay"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2404.02151","atlas_url":"https://app.syntology.ai/?focus=2404.02151","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2404.02151"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/tml-epfl/llm-adaptive-attacks","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":7,"ran_draft_wrong":1},"by_repo_kind":{"official":{"samples":8,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d7a1e728e5b74d3f","entry":"extract_json","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"common.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/common.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d7a1e728e5b74d3f"}},{"code_sha256_prefix":"e5d6b48c8179a8d3","entry":"get_init_msg","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"common.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/common.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e5d6b48c8179a8d3"}},{"code_sha256_prefix":"60e7444ebd37a613","entry":"get_judge_system_prompt","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"prompts.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/prompts.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"60e7444ebd37a613"}},{"code_sha256_prefix":"f068afb2c6ea7a65","entry":"get_universal_manual_prompt","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"prompts.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/prompts.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f068afb2c6ea7a65"}},{"code_sha256_prefix":"7ee9f8f9d7d18561","entry":"insert_adv_string","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"utils.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7ee9f8f9d7d18561"}},{"code_sha256_prefix":"1defc435fe20c199","entry":"judge_rule_based","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"judges.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/judges.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1defc435fe20c199"}},{"code_sha256_prefix":"9fdfb4537f5fd761","entry":"process_target_response","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"common.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/common.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9fdfb4537f5fd761"}},{"code_sha256_prefix":"e16b1b174bb196d2","entry":"schedule_n_to_change_fixed","repo":"tml-epfl/llm-adaptive-attacks","repo_kind":"official","path":"utils.py","file_url":"https://github.com/tml-epfl/llm-adaptive-attacks/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e16b1b174bb196d2"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}