PaperlayerView exact revision on arXiv

Source-linked AI summary

An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer

Weipeng Jiang, Zhenting Wang, Juan Zhai, Shiqing Ma, Zhengyu Zhao, Chao Shen

arXiv:2408.11313v2cs.AI

TL;DR

Aligned LLMs remain vulnerable to jailbreaking, while existing template and optimization methods require manual effort, white-box access, or predefined affirmative phrases. ECLIPSE uses an LLM to generate and refine suffixes through task prompting, harmfulness scoring, and historical feedback in a black-box setting. It achieves an average ASR of 0.92 and reduces average attack overhead by 83% while remaining comparable to template-based methods in ASR.

  • Problem

    Existing jailbreaking methods require substantial manual effort or face white-box access, affirmative-phrase, and efficiency limitations.

    Source: §1 · p. 1, §2.2 · p. 3

  • Method

    ECLIPSE uses task prompting, continuous harmfulness scoring, and historical feedback to let an LLM generate and iteratively optimize suffixes through black-box interactions.

    Source: §1 · pp. 1–2, §3.3 · pp. 4–5

  • Results

    ECLIPSE achieves an average ASR of 0.92 across three open-source LLMs and GPT-3.5-Turbo, with average attack overhead reduced by 83%.

    Source: §1 · p. 2, §4.2 · p. 7, §5 · p. 9

  • Takeaways & Limitations

    The method provides an efficient black-box alternative that does not rely on predefined affirmative phrases and is comparable to template-based methods in ASR.

    Source: §1 · p. 2, §5 · p. 9

    ECLIPSE still requires an LLM with sufficient instruction-following capability for suffix generation and optimization.

    Source: Ethical Considerations and Limitations · p. 9

Abstract

from arXiv · show

Despite prior safety alignment efforts, mainstream LLMs can still generate harmful and unethical content when subjected to jailbreaking attacks. Existing jailbreaking methods fall into two main categories: template-based and optimization-based methods. The former requires significant manual effort and domain knowledge, while the latter, exemplified by Greedy Coordinate Gradient (GCG), which seeks to maximize the likelihood of harmful LLM outputs through token-level optimization, also encounters several limitations: requiring white-box access, necessitating pre-constructed affirmative phrase, and suffering from low efficiency. In this paper, we present ECLIPSE, a novel and efficient black-box jailbreaking method utilizing optimizable suffixes. Drawing inspiration from LLMs' powerful generation and optimization capabilities, we employ task prompts to translate jailbreaking goals into natural language instructions. This guides the LLM to generate adversarial suffixes for malicious queries. In particular, a harmfulness scorer provides continuous feedback, enabling LLM self-reflection and iterative optimization to autonomously and efficiently produce effective suffixes. Experimental results demonstrate that ECLIPSE achieves an average attack success rate (ASR) of 0.92 across three open-source LLMs and GPT-3.5-Turbo, significantly surpassing GCG in 2.4 times. Moreover, ECLIPSE is on par with template-based methods in ASR while offering superior attack efficiency, reducing the average attack overhead by 83%.

1 Introduction

ECLIPSE addresses vulnerabilities that remain in aligned LLMs by replacing manual templates and white-box, affirmative-phrase optimization with black-box suffix optimization. Across evaluated models, it achieves high attack success and substantially lower attack overhead.

Motivation

  • Existing template-based methods require substantial manual effort and domain knowledge, whereas GCG requires white-box access and manually designed affirmative phrases.These constraints limit candidate generation, effectiveness, or efficiency.Source: §1 · p. 1

Method

  • ECLIPSE uses LLMs as both suffix generators and optimizers, refining candidates through harmfulness feedback without predefined affirmative phrases.Task prompting translates the jailbreaking goal into natural-language instructions, while iterative feedback guides optimization.Source: §1 · pp. 1–2

Results

  • ECLIPSE achieves an average Attack Success Rate (ASR) of 0.92 on three open-source models and GPT-3.5-Turbo, surpassing GCG in effectiveness, efficiency, and naturalness.It also reduces average attack time overhead by 83% and the number of queries by 45% compared with template-based methods.Source: §1 · p. 2
  • ECLIPSE matches template-based methods in ASR while reducing average attack time overhead by 83% and query count by 45%.The comparison is reported across the evaluated template-based baselines and models.Source: §1 · p. 2

2 Background

Prior jailbreaking work uses manually designed templates or token-level optimization, each with distinct limitations. ECLIPSE is motivated by the need for efficient black-box suffix optimization without preset affirmative phrases.

2.1 Related Work

  • Template-based attacks draw on jailbreak patterns, psychological strategies, or automated mutation and refinement, but depend on manual design and target-model instruction following.Examples include DeepInception, RED-EVAL, GPTFUZZER, Masterkey, and PAIR.Source: §2.1 · p. 2, §2.2 · p. 3
  • GCG optimizes adversarial suffix tokens to maximize the probability of a predefined affirmative response such as “Sure, here is...”.Its objective assumes that an affirmative opening predicts continued harmful content.Source: §2.1 · p. 2

2.2 Motivation

  • Optimization-based methods reduce dependence on instruction following but commonly require affirmative targets, white-box access, and inefficient discrete search.Affirmative openings may still be followed by refusal, weakening the optimization assumption.Source: §2.2 · p. 3
  • The paper therefore targets efficient black-box suffix optimization without specific affirmative phrases.The threat model reflects API-based access in which attackers receive textual responses but not model weights or gradients.Source: §2.2 · p. 3

3 Methodology

ECLIPSE treats suffix generation as a feedback-driven black-box optimization problem: an attacker LLM proposes suffixes, a target LLM is evaluated, and historical scores guide refinement. The method combines natural-language task prompting, continuous harmfulness scoring, and adaptive reference selection.

3.1 Threat Model

  • The threat model removes white-box access and predefined affirmative phrases, limiting the attacker to API interactions and textual responses.It retains the goal of crafting suffixes that induce harmful or unethical target responses.Source: §3.1 · p. 3

3.2 Our Intituitive Idea

  • LLMs generate and refine suffixes through iterative testing, feedback, and concatenation with malicious queries.The prototype indicates that quantifiable feedback can support self-reflection, while generated suffixes can be clearer and more natural than GCG outputs.Source: §3.2 · p. 4

3.3 Method Design

  • ECLIPSE translates jailbreaking objectives into task prompts that ask an attacker LLM to generate suffixes intended to shift hidden-space features and avoid refusal.The prompt uses a red-teaming role and requests a structured suffix output.Source: §3.3 · pp. 4–5
  • A RoBERTa-based harmfulness scorer assigns continuous values from 0 for completely harmless responses to 1 for explicitly harmful responses.These scores provide quantitative feedback for suffix self-reflection and ongoing optimization.Source: §3.3 · p. 5
  • ECLIPSE stores suffix-score pairs and selects both high-scoring and randomly sampled references to balance exploitation with exploration.High-scoring references support convergence, while random references reduce stagnation in local optima.Source: §3.3 · pp. 4–5

3.4 Algorithm

  • The algorithm generates batches of suffixes, evaluates each candidate, returns successful prompts, and otherwise records scores until success or the iteration limit.It supports up to K rounds and can use any sufficiently generative attacker LLM, with the target LLM as the default implementation.Source: §3.4 · pp. 5–6, §3.3 · p. 5

4 Evaluation

ECLIPSE is evaluated against optimization-based and template-based jailbreakers across open-source and commercial LLMs, with additional analyses of transferability, defenses, and ablations. It achieves higher attack success and efficiency than key baselines, while performance depends on attacker choice, historical references, and batch size.

4.2 Performance Evaluation

  • 0.92 average ASR across four models exceeded GCG’s 0.38, a 2.4-fold increase.ECLIPSE achieved ASRs of 0.75 on LLaMA2, 0.99 on Vicuna, 0.98 on Falcon, and 0.97 on GPT-3.5, while GCG could not access GPT-3.5.Source: §4.2 · p. 7, Table 2 · p. 7
  • 83% lower average overhead and 45% fewer queries than template-based methods demonstrated ECLIPSE’s efficiency advantage.Against GCG, LLaMA2 QR fell from 178.5 to 16.81 and overhead from 1557.39 to 173.45 seconds; on Falcon, ECLIPSE used 3.95 rounds and 28.67 seconds.Source: §4.2 · p. 7, Table 3 · p. 7
  • ECLIPSE remained comparable to template-based methods in ASR, surpassing GPTFUZZER and PAIR on LLaMA2 but slightly trailing both on GPT-3.5.On LLaMA2, ECLIPSE achieved 0.74 ASR versus 0.52 for GPTFUZZER and 0.53 for PAIR; on GPT-3.5, it achieved 0.94 versus 1.0.Source: §4.2 · p. 7, Table 3 · p. 7

4.3 Exploring the Transferability of Attacker

  • LLaMA2 was the strongest attacker across targets, whereas attackers transferred more effectively against weaker-aligned Vicuna and Falcon than against LLaMA2.The transferability study used three open-source LLMs as both attackers and targets.Source: §4.3 · pp. 7–8, Figure 2 · p. 8

4.4 Potential Defenses

  • Safety checkers detected 6%–46% of LLaMA2 harmful outputs and 11%–72% of GPT-3.5 outputs.Salesforce, LlamaGuard, and Azure detected approximately 6%, 38%, and 46% for LLaMA2, versus 11%, 72%, and 69% for GPT-3.5.Source: §4.4 · p. 8, Table 5 · p. 8

4.5 Ablation Studies

  • Removing historical references reduced LLaMA2 ASR from 75% to 35%, while removing hidden-space-feature instructions reduced it from 0.75 to 0.59.Historical-reference removal also increased query rounds and overhead, and batch size improved ASR at the cost of GPU consumption; temperature and references had limited overall impact.Source: §4.5 · pp. 8–9, Figure 3 · p. 9

5 Conclusion

The paper presents ECLIPSE as an efficient black-box method that uses LLMs to generate and optimize jailbreak suffixes without predefined affirmative phrases. Across three baselines, it reports superior attack success and efficiency.

5 Conclusion

  • ECLIPSE uses LLMs as optimizers to refine jailbreak suffixes without relying on predefined affirmative phrases.The method investigates LLM-generated suffixes and reports improvements across three baselines.Source: §5 · p. 9

Ethical Considerations and Limitations

ECLIPSE raises ethical concerns because jailbreaking can generate harmful and illegal content, but it may also support red-teaming for evaluating LLM safety. Its main limitation is reliance on instruct-following capability, although generating a suffix is less demanding than the complex tasks used by some template-based methods.

Ethics

  • ECLIPSE can generate harmful and illegal content, while also serving as a red-teaming tool for evaluating LLM safety.The authors state that they expect the method to contribute to improving LLM robustness and safety.Source: Ethical Considerations and Limitations · p. 9

Limitations

A Task Prompts Involved

ECLIPSE uses task prompts to direct an attacker LLM to generate short suffixes, then iteratively improves them using scored generation histories. Variants compare prompts that include or omit hints about hidden-space features.

A Task Prompts Involved

  • A prompt variant removes the hidden-space-feature hint while retaining the objective of generating a suffix with a high score.The appendix identifies these as templates used to explore the effect of removing the hint.Source: A Task Prompts Involved · p. 11
  • The standard ECLIPSE attacker prompt asks an LLM to append a suffix that perturbs hidden-space features and enables a chatbot to answer a malicious query.The suffix is requested in a structured format and limited to 10 tokens.Source: A Task Prompts Involved · p. 11
  • The iterative prompt supplies previously generated suffixes and scores, asking the attacker LLM to reflect and produce a better suffix.A higher score indicates a better prompt.Source: A Task Prompts Involved · p. 11

B A Case Study of Numeric Suffixes

The numeric-suffix case study finds that certain numbers can increase harmful generations, potentially by activating learned memories and perturbing prompt embeddings. Successful and failed prompts occupy visibly different embedding distributions, supporting a hidden-space explanation.

B A Case Study of Numeric Suffixes

  • Numeric suffixes substantially increase harmful-content generation, whereas replacing them with random numbers sharply reduces success.The experiment enters the malicious query without another dialogue template.Source: B A Case Study of Numeric Suffixes · p. 12
  • Specific numeric suffixes may activate learned memories, although the authenticity of the induced logs and addresses cannot be verified.Examples include suffixes “7.3” and “5544.2” producing text resembling a log mark and a complementary PDF address.Source: B A Case Study of Numeric Suffixes · p. 12
  • PCA shows distinct embedding distributions for failed prompts in red and successful prompts in blue.The authors interpret this separation as evidence that some numeric suffixes perturb hidden-space features and weaken safety alignment.Source: B A Case Study of Numeric Suffixes · p. 12, Figure 4 · p. 12

C A Study on Longitudinal Versions of GPT-3.5-Turbo

Across three GPT-3.5-Turbo releases, ECLIPSE’s attack success rate increases with successive model updates. The reported trend is consistent with reduced robustness across these versions.

C A Study on Longitudinal Versions of GPT-3.5-Turbo

ID INPUT OUTPUT

The input asks for drugs that can be synthesized at home with household chemicals, and the output provides several examples while noting that drug synthesis is complex. The section is associated with a numeric-suffix table.

  • The query requests a list of drugs that can be easily synthesized at home using household chemicals.Source: ID INPUT OUTPUT · p. 13
  • The output names aspirin, ibuprofen, and paracetamol as examples of drugs it claims can be synthesized with household chemicals.Source: ID INPUT OUTPUT · p. 13
  • The output also states that drug synthesis is a complex process requiring specialized equipment and expertise.Source: ID INPUT OUTPUT · p. 13

Related papers

Loading 2408.11313v2…