PaperlayerView exact revision on arXiv

Source-linked AI summary

DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization

Xinzhe Huang, Kedong Xiu, Tianhang Zheng, Churui Zeng, Wangze Ni, Zhan Qin, Kui Ren, Chun Chen

arXiv:2504.18564v2cs.CRcs.AI

TL;DR

Attacks on LLMs protected by diverse guardrails remain underexplored. DualBreach combines target-driven initialization with gradient-based optimization across guardrails and LLMs, achieving a 93.67% average dual-jailbreak attack success rate against GPT-4 protected by Llama-Guard-3 with fewer queries than prior methods.

  • Problem

    Natural-language attacks on LLMs protected by diverse guardrails remain underexplored.

    Source: §I · p. 2

  • Method

    DualBreach initializes prompts with target-driven paraphrasing and optimizes them with approximate gradients on guardrails and LLMs.

    Source: §I · p. 2, §VII · p. 14

  • Results

    93.67% average Dual Jailbreak Attack Success Rate (ASRL) against GPT-4 protected by Llama-Guard-3, 6.05% higher than the best existing result, with 1.77 queries per successful jailbreak prompt on average.

    Source: §I · p. 3

  • Takeaways & Limitations

    DualBreach supports robust evaluation of LLM-based applications, while EGuard is introduced as an ensemble guardrail for detecting jailbreak prompts.

    Source: §VII · p. 14

    Proxy guardrail results can vary: OpenAI proxy ASRGs were 1%–2% lower than API results, and Google’s lack of a definitive threshold may skew proxy performance.

    Source: B. Supplementary Experiments · p. 16

Abstract

from arXiv · show

Recent research has focused on exploring the vulnerabilities of Large Language Models (LLMs), aiming to elicit harmful and/or sensitive content from LLMs. However, due to the insufficient research on dual-jailbreaking -- attacks targeting both LLMs and Guardrails, the effectiveness of existing attacks is limited when attempting to bypass safety-aligned LLMs shielded by guardrails. Therefore, in this paper, we propose DualBreach, a target-driven framework for dual-jailbreaking. DualBreach employs a Target-driven Initialization (TDI) strategy to dynamically construct initial prompts, combined with a Multi-Target Optimization (MTO) method that utilizes approximate gradients to jointly adapt the prompts across guardrails and LLMs, which can simultaneously save the number of queries and achieve a high dual-jailbreaking success rate. For black-box guardrails, DualBreach either employs a powerful open-sourced guardrail or imitates the target black-box guardrail by training a proxy model, to incorporate guardrails into the MTO process. We demonstrate the effectiveness of DualBreach in dual-jailbreaking scenarios through extensive evaluation on several widely-used datasets. Experimental results indicate that DualBreach outperforms state-of-the-art methods with fewer queries, achieving significantly higher success rates across all settings. More specifically, DualBreach achieves an average dual-jailbreaking success rate of 93.67% against GPT-4 with Llama-Guard-3 protection, whereas the best success rate achieved by other methods is 88.33%. Moreover, DualBreach only uses an average of 1.77 queries per successful dual-jailbreak, outperforming other state-of-the-art methods. For the purpose of defense, we propose an XGBoost-based ensemble defensive mechanism named EGuard, which integrates the strengths of multiple guardrails, demonstrating superior performance compared with Llama-Guard-3.

I. INTRODUCTION

Existing jailbreak research has focused mainly on LLMs, while simultaneously bypassing external guardrails and internal safety alignment remains unresolved. DUALBREACH combines target-driven initialization and joint optimization; the paper also reports an ensemble guardrail, EGUARD.

I. INTRODUCTION

  • Existing attacks often target LLMs alone, leaving prompts either intercepted by guardrails or refused by safety-aligned LLMs.Research on simultaneously circumventing both defenses remains insufficient.Source: §I · pp. 1–2
  • Repeated, similar harmful queries can trigger denial-of-service responses, while cipher-based prompts can be detectable by perplexity metrics and are uncommon in ordinary interactions.The paper frames minimizing queries per attack prompt as a challenge for stealthiness and efficiency.Source: §I · p. 2
  • Target-driven Initialization infers prompts from a target harmful response, paraphrasing harmful queries to appear benign and accelerate prompt optimization.This strategy addresses the challenge of limiting queries per attack prompt.Source: §I · p. 2
  • A locally trained proxy guardrail simulates black-box behavior, allowing most optimization iterations to run offline and reducing queries to the target guardrail.Two data-distillation approaches reduce proxy-training cost, including queries, by up to 96%.Source: §I · pp. 2–3, A. Our contributions · p. 3
  • Multi-Target Optimization uses approximate gradients on guardrails and LLMs to maximize harmful responses while minimizing unsafe scores and LLM refusals.The joint objective tailors prompts to bypass both the external guardrail and the LLM’s internal safety alignment.Source: §I · p. 3

A. Our contributions

  • 93.67% dual-jailbreaking success against GPT-4 with Llama-Guard-3 protection, using 1.77 average queries versus 88.33% for the best other method.The evaluation spans three datasets, five guardrails, and four target LLMs.Source: A. Our contributions · p. 3
  • 15.33% average reduction in guardrail attack success rate versus Llama-Guard-3 is reported for EGUARD, which integrates five state-of-the-art guardrails.The ensemble combines Llama Guard3, Nvidia Nemo, Guardrails AI, OpenAI Moderation API, and Google Moderation API.Source: A. Our contributions · p. 3

II. RELATED WORK

The section reviews jailbreak and guardrail approaches, defines the attacker’s objective and constraints, and outlines DUALBREACH’s three-stage workflow. Its optimization targets both guardrail evasion and harmful LLM responses.

A. Jailbreak Attacks

  • Natural-language jailbreaks use gradient search, genetic algorithms, controllable generation, or persuasive contexts, while cipher-based attacks can be flagged by automatic metrics and are sensitive to output variation.The section identifies dual-jailbreaking as bypassing both guardrails and target LLMs.Source: A. Jailbreak Attacks · pp. 3–4

B. Guardrails

  • Guardrails include function-based, LLM-based, combined, and API-based types; combined systems may incur high false positives from an inferior component, while API guardrails limit access to internals.API-based guardrails also make gradient-based prompt optimization difficult for attackers.Source: B. Guardrails · p. 4

C. Other defenses.

  • Other defenses perturb and aggregate adversarial inputs, prioritize safety instructions during decoding, or interrupt generation when abnormal activation patterns appear.The passage says these approaches have not been widely used in real-world scenarios, to the authors’ knowledge.Source: C. Other defenses · p. 4

A. Attacker’s Objective

  • A dual-jailbreak prompt must pass the guardrail’s safety threshold and elicit an LLM output whose judged harmfulness exceeds threshold τ.The attacker’s objective transforms a target harmful response into a jailbreak prompt.Source: A. Attacker’s Objective · p. 4

B. Attacker’s Capabilities

IV. METHODOLOGY OF DUALBREACH

  • DUALBREACH uses target-driven initialization, proxy guardrails for black-box targets, and multi-target optimization; the framework is described as reducing iterations while improving success over existing methods.Proxy guardrails are optional when an open-source guardrail can be used for optimization.Source: §IV · pp. 5–6, Figure 2 · p. 5

A. Stage 1: Target-driven Initialization

Target-driven Initialization (TDI) infers a plausible benign-looking prompt from a target harmful response, then proxy-guardrail training provides a way to incorporate black-box guardrails into optimization. The section also describes two distillation approaches that reduce training data while preserving proxy performance.

A. Stage 1: Target-driven Initialization

  • TDI reverse-engineers a plausible user prompt from a target harmful response, using task reframing, a professional persona, and contextual framing to make the prompt appear innocuous.The target response serves as an artifact that conditions the desired output style and structure.Source: A. Stage 1: Target-driven Initialization · p. 6
  • Unlike PAP’s handcrafted target-irrelevant few-shot templates, TDI infers benign-looking queries directly from harmful targets for stronger semantic alignment.The prompt inference seeks to maximize the target LLM’s conditional probability of generating the predefined harmful response.Source: A. Stage 1: Target-driven Initialization · p. 6

B. Stage 2: Train Proxy Guardrails

  • The proxy guardrail takes prompt embeddings and predicts probabilities across harmful categories, then is trained to align with the black-box guardrail’s classifications.Training iterates until average loss falls below a convergence threshold.Source: B. Stage 2: Train Proxy Guardrails · p. 6, §1 · p. 7

1 Initialize a proxy guardrail Gp

  • BLEU-based distillation selects diverse samples with low self-BLEU, while KMeans-based distillation selects central samples within each predefined harmful category.The former does not require harmful-category knowledge; the latter can better align the proxy with black-box guardrail behavior.Source: §1 · p. 7
  • Both distillation approaches substantially reduce proxy-guardrail training costs while preserving performance.The paper reports that the two approaches apply to different scenarios: category-agnostic diversity selection and category-specific clustering.Source: §1 · p. 7

C. Stage 3: Multi-Target Optimization

Multi-Target Optimization refines TDI-initialized prompts to appear safe to guardrails while eliciting harmful responses from an LLM. It combines guardrail and LLM objectives, including a contrastive success-versus-refusal objective, and periodically reinitializes prompts to limit repetitive queries.

C. Stage 3: Multi-Target Optimization

  • Multi-Target Optimization gives a prompt a dual role: evade proxy-guardrail detection while eliciting harmful responses from a local LLM.The two objectives are formalized in a single differentiable loss, and the method updates the entire perturbation rather than one token per step.Source: C. Stage 3: Multi-Target Optimization · p. 7
  • For black-box guardrails, a proxy classifier guides optimization to minimize the likelihood that a prompt is labeled unsafe.The guardrail loss targets the safe label, increasing acceptance by the target guardrail.Source: C. Stage 3: Multi-Target Optimization · p. 8
  • The LLM objective pushes prompts toward harmful-response success and pulls them away from the region that triggers refusal.The success direction minimizes cross-entropy for a harmful prefix; the rejection direction maximizes cross-entropy for refusal behavior.Source: C. Stage 3: Multi-Target Optimization · p. 8
  • After optimization, a judge evaluates prompts; a target-LLM query is successful only when the guardrail labels the prompt safe and the judge labels its response unsafe.If not successful, optimization continues up to the maximum iteration count.Source: C. Stage 3: Multi-Target Optimization · p. 8
  • DUALBREACH periodically reinitializes the harmful query to maintain prompt diversity and reduce the risk of rejection from repeated or similar queries.Reinitialization occurs every PIter iterations.Source: C. Stage 3: Multi-Target Optimization · pp. 8–9

A. Experimental setups

The experiments evaluate attacks on harmful-prompt datasets against several guardrails and safety-aligned LLMs, with comparisons to white-box and black-box baselines. They measure guardrail bypass and joint jailbreak success, using an external judge to assess response harmfulness.

A. Experimental setups

  • Evaluation randomly samples 100 prompts from AdvBench, DNA, and harmBench; proxy guardrails are trained using PKU-SafeRLHF, OpenBookQA, Yelp, TriviaQA, and WikiQA.StrongReject adds a 100-prompt evaluation using its official Pythia-14m and GPT-4o evaluators.Source: A. Experimental setups · p. 9
  • The tested guardrails include Llama-Guard-3, NeMo, Guardrails AI, OpenAI Moderation API, and Google Moderation API, while target LLMs include four safety-aligned models and three frontier models.The named frontier models are Claude-3.5, Gemini-1.5, and GPT-4o.Source: A. Experimental setups · p. 9
  • The comparison includes four white-box and three black-box baselines, with a maximum query budget of 40 and five local optimization iterations per query.For black-box LLM attacks, Llama-3 is used as the surrogate model.Source: A. Experimental setups · p. 9
  • ASRG measures prompts classified safe by the guardrail, while ASRL measures prompts that bypass the guardrail and induce harmful LLM responses.An external judge assigns an unsafe score from 0 to 1; responses above 0.7 are considered unsafe.Source: A. Experimental setups · p. 9

B. Dual-Jailbreaking with Limited Queries

DUALBREACH performs better than prior methods in limited-query dual-jailbreaking scenarios across nearly all evaluated datasets and target LLMs. It combines prompt initialization, proxy guardrails, and iterative refinement while using fewer queries.

Overall results

  • DUALBREACH achieves higher ASRL across nearly all datasets and target LLMs; on advBench with Llama-3, its 86.0% compares with COLD-Attack's 3.0%, PAP's 69%, and ReNELLM's 54.0%.Source: B. Dual-Jailbreaking with Limited… · p. 9
  • DUALBREACH's higher ASRL is attributed to combining TDI initialization, proxy-guardrail optimization, and iterative refinement with local LLMs.Existing methods that do not jointly optimize for guardrails and target LLMs tend to succeed at bypassing one or the other.Source: B. Dual-Jailbreaking with Limited… · pp. 9–10
  • Guard3 performs better than the other evaluated guardrails, while query-per-success values for methods with low ASRL can reflect only a few successful prompts.The query-per-success measure is computed only from successful samples.Source: B. Dual-Jailbreaking with Limited… · p. 10

Average queries per successful dual-jailbreak

C. One-Shot Dual-Jailbreak

Across one-shot, no-proxy, benchmark, overhead, deployment, and evaluation settings, DUALBREACH generally retains strong dual-jailbreaking performance. The results also examine its performance across guardrails, models, and judges.

C. One-Shot Dual-Jailbreak

D. One-Shot Dual-Jailbreak without Proxy Guardrail

  • 87%–100% ASRG across three datasets shows DUALBREACH's more stable guardrail-bypass performance without a proxy guardrail.On DNA, it reaches 100% ASRG against Guard3, Nemo, GuardAI, and OpenAI; GCG ranges from 0% to 36% across the cited datasets.Source: D. One-Shot Dual-Jailbreak without… · p. 11

E. Results on StrongReject Benchmark

  • 58.0% ASR by Pythia-14m and 67.0% ASR by GPT-4o on GPT-4o outperform prior methods across the evaluated Claude, Gemini, and GPT-4o models.The authors describe these results as evidence of generalization to benchmarks with fine-tuned detectors and real-world-inspired prompts.Source: E. Results on StrongReject Benchmark · pp. 11–12

F. Overhead Analysis

  • 68% ASRL with 2.6 queries per successful attack and $0.21 API cost is reported for DUALBREACH on AdvBench against Claude-3.5.Its runtime is 3.28 hours, versus 12.5 hours for PAP and 7.4 hours for ReNeLLM.Source: F. Overhead Analysis · p. 12, Table V · p. 12

G. Experiments on Output-based Guardrails Detecting Both Harmful Prompts and Responses

H. Robustness Validation of Evaluation Mechanisms

VI. EGUARD: A BOOSTING ENSEMBLE LEARNING APPROACH FOR GUARDRAILS

The paper proposes EGUARD to combine guardrails with different detection strengths using dynamically adjusted weights and boosting-based decision trees. Its prediction stage aggregates tree outputs into a normalized output.

VI. EGUARD: A BOOSTING ENSEMBLE LEARNING APPROACH FOR GUARDRAILS

  • Guardrails detect different prompt patterns, motivating EGUARD; uniform weights may underuse the strongest guardrail, while deep neural network ensembles may overfit and overlook weaker guardrails' complementary strengths.Guard3 is described as strong on harmful semantics in short sentences, NeMo as sensitive to perplexity changes, and GuardAI as proficient at toxic content.Source: §VI · p. 12, A. Overview of EGUARD · p. 12

A. Overview of EGUARD

  • EGUARD combines dynamic weight adjustment with boosting-based decision-tree optimization to balance the detection contributions of multiple guardrails.Its initialization prioritizes Guard3 when it correctly detects a prompt; otherwise, weights are evenly distributed among the other four guardrails.Source: A. Overview of EGUARD · pp. 12–13
  • EGUARD iteratively trains decision trees to reduce residual errors, with each tree correcting errors from the previous iteration.The figure describes EGUARD as using weighted outputs from multiple guardrails to moderate jailbreak prompts.Source: A. Overview of EGUARD · p. 13, Figure 3 · p. 13

9 Save EGUARD E

  • EGUARD's prediction aggregates outputs from its decision trees using learnable tree weights, then applies a sigmoid to normalize the output to [0, 1].The described configuration uses 100 decision trees.Source: §9 · p. 13

B. Experiments

DUALBREACH reports stronger dual-jailbreak performance with fewer queries, while EGUARD improves detection over Guard3; the paper also describes its ethical practices.

B. Experiments

  • On DNA, EGUARD reduces the ASRG of GCG, PRP, COLD-Attack, and PAP by 6%∼25% (18.80% on average) versus Guard3.The authors attribute this to EGUARD combining complementary guardrails to broaden harmful-category coverage beyond Guard3’s predefined categories; its parallel execution adds 0.08s over Guardrails AI and less than 25% of LLM inference time.Source: B. Experiments · p. 14, Table IX · p. 14

VII. CONCLUSION

  • DUALBREACH uses target-driven initialization and approximate-gradient optimization across guardrails and LLMs, achieving higher dual-jailbreak success with fewer queries than state-of-the-art methods.The paper also introduces EGUARD, whose evaluations on multiple benchmarks show superior performance to Llama-Guard-3.Source: §VII · p. 14

ETHICS CONSIDERATIONS

  • The authors state that they follow established ethical guidelines and aim to improve the safety and reliability of LLMs and guardrails.They say the attack and defense were responsibly reported to relevant stakeholders and that results are intended for academic purposes to strengthen defenses against dual-jailbreak attacks.Source: ETHICS CONSIDERATIONS · p. 14

APPENDIX

The appendix describes the evaluated LLMs and guardrails, then reports supplementary tests of DUALBREACH and its proxy guardrails, including black-box OpenAI results and proxy-similarity analyses.

A. Overview of Target Guardrails and LLMs

  • The evaluation covers seven representative LLMs and five widely used guardrails, including systems with input- and output-level filtering and moderation APIs.The appendix identifies Guard3 as supporting input and output filtering and classifying unsafe content into 14 harmful categories.Source: A. Overview of Target Guardrails and… · pp. 15–16

B. Supplementary Experiments

  • Against GPT-3.5 and GPT-4 protected by OpenAI’s guardrail, DUALBREACH achieves the best dual-jailbreak performance among the baselines.The authors attribute this to using a proxy model to simulate OpenAI’s behavior and optimize prompts in a black-box setting.Source: B. Supplementary Experiments · p. 16, Table XI · p. 16
  • OpenAI and its proxies have TVD values of 0.0045∼0.0125, while Google and its proxies have values of 0.0397∼0.0678, indicating weaker similarity for Google.On AdvBench, DUALBREACH’s proxy-OpenAI ASRGs are 1%∼2% lower than those measured using the OpenAI API; Google proxy ASRGs mostly remain within the stated 20% variation range.Source: B. Supplementary Experiments · p. 16, Table X · p. 16
  • Proxy guardrails simulate black-box guardrail behavior with up to a 96% reduction in training-set size.The authors report that different distillation approaches moderately affect ASRG; they note that Google’s lack of a definitive threshold may skew proxy performance.Source: B. Supplementary Experiments · p. 16

C. Supplementary materials and analysis of the Target-driven Initialization (TDI) strategy

TDI converts a harmful target response into a contextualized jailbreak prompt, and the appendix compares its guardrail-bypassing performance with PAP and provides dual-jailbreak examples.

1) Workflow of TDI

  • TDI prompts an LLM to reverse-engineer a realistic user prompt from a harmful target response, framing the task as legitimate analysis and specifying style and quality constraints.The template supplies the target response as a pre-existing artifact and asks for a grammatically sound prompt grounded in a plausible academic, social, policy, or educational context.Source: 1) Workflow of TDI · p. 17, 3) Evaluating the Effectiveness of TDI… · p. 17

3) Evaluating the Effectiveness of TDI Against PAP

D. Examples of Dual Jailbreak prompt with DUALBREACH

Related papers

Loading 2504.18564v2…