{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/refusal-trained-llms-are-easily-jailbroken-as","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","arxiv_id":"2410.13886","date":"2024-10-11","proceeding":null,"authors":["Priyanshu Kumar","Elaine Lau","Saranya Vijayakumar","Tu Trinh","Scale Red Team","Elaine Chang","Vaughn Robinson","Sean Hendryx","Shuyan Zhou","Matt Fredrikson","Summer Yue","Zifan Wang"],"abstract":"For safety reasons, large language models (LLMs) are trained to refuse harmful user instructions, such as assisting dangerous activities. We study an open question in this work: does the desired safety refusal, typically enforced in chat contexts, generalize to non-chat and agentic use cases? Unlike chatbots, LLM agents equipped with general-purpose tools, such as web browsers and mobile devices, can directly influence the real world, making it even more crucial to refuse harmful instructions. In this work, we primarily focus on red-teaming browser agents, LLMs that manipulate information via web browsers. To this end, we introduce Browser Agent Red teaming Toolkit (BrowserART), a comprehensive test suite designed specifically for red-teaming browser agents. BrowserART is consist of 100 diverse browser-related harmful behaviors (including original behaviors and ones sourced from HarmBench [Mazeika et al., 2024] and AirBench 2024 [Zeng et al., 2024b]) across both synthetic and real websites. Our empirical study on state-of-the-art browser agents reveals that, while the backbone LLM refuses harmful instructions as a chatbot, the corresponding agent does not. Moreover, attack methods designed to jailbreak refusal-trained LLMs in the chat settings transfer effectively to browser agents. With human rewrites, GPT-4o and o1-preview-based browser agents attempted 98 and 63 harmful behaviors (out of 100), respectively. We publicly release BrowserART and call on LLM developers, policymakers, and agent developers to collaborate on improving agent safety","url_abs":"https://arxiv.org/abs/2410.13886v2","url_pdf":"https://arxiv.org/pdf/2410.13886v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"refusal-trained-llms-are-easily-jailbroken-as","repo_url":"https://github.com/scaleapi/browser-art","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"chatbot","task_name":"Chatbot"},{"task_slug":"red-teaming","task_name":"Red Teaming"}],"methods":[{"method_slug":"focus","method_name":"Focus"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2410.13886","atlas_url":"https://app.syntology.ai/?focus=2410.13886","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2410.13886"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/scaleapi/browser-art","reach":{"status":"ok","spdx":"NOASSERTION"}}],"summary":{"ran":4,"ran_draft_wrong":1,"ran_violates":1},"by_repo_kind":{"official":{"samples":6,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"52ef8d3cd909896d","entry":"batch_completion","repo":"scaleapi/browser-art","repo_kind":"official","path":"src/text-mode/litellm_batch.py","file_url":"https://github.com/scaleapi/browser-art/blob/HEAD/src/text-mode/litellm_batch.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"52ef8d3cd909896d"}},{"code_sha256_prefix":"45c33af255d83365","entry":"get_error_prefix","repo":"scaleapi/browser-art","repo_kind":"official","path":"src/agents/OpenDevin/agenthub/browsing_agent/browsing_agent.py","file_url":"https://github.com/scaleapi/browser-art/blob/HEAD/src/agents/OpenDevin/agenthub/browsing_agent/browsing_agent.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"45c33af255d83365"}},{"code_sha256_prefix":"dd9d65d0d8999bb0","entry":"get_prompt","repo":"scaleapi/browser-art","repo_kind":"official","path":"src/agents/OpenDevin/agenthub/browsing_agent/browsing_agent.py","file_url":"https://github.com/scaleapi/browser-art/blob/HEAD/src/agents/OpenDevin/agenthub/browsing_agent/browsing_agent.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"dd9d65d0d8999bb0"}},{"code_sha256_prefix":"127384b2b2f0aad5","entry":"get_system_message","repo":"scaleapi/browser-art","repo_kind":"official","path":"src/agents/OpenDevin/agenthub/browsing_agent/browsing_agent.py","file_url":"https://github.com/scaleapi/browser-art/blob/HEAD/src/agents/OpenDevin/agenthub/browsing_agent/browsing_agent.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"127384b2b2f0aad5"}},{"code_sha256_prefix":"8bfb1e7a51fda8ec","entry":"normal_new_context_async","repo":"scaleapi/browser-art","repo_kind":"official","path":"src/agents/seaact_agent/seeact_agent/SeeAct/src/demo_utils/browser_helper.py","file_url":"https://github.com/scaleapi/browser-art/blob/HEAD/src/agents/seaact_agent/seeact_agent/SeeAct/src/demo_utils/browser_helper.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"8bfb1e7a51fda8ec"}},{"code_sha256_prefix":"7c508037b40522af","entry":"str2bool","repo":"scaleapi/browser-art","repo_kind":"official","path":"src/agents/OpenDevin/BrowserGym/demo_agent/run_demo.py","file_url":"https://github.com/scaleapi/browser-art/blob/HEAD/src/agents/OpenDevin/BrowserGym/demo_agent/run_demo.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7c508037b40522af"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}