TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization

Matan Ben-Tov; Mahmood Sharif

Source-linked AI summary

TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization

Matan Ben-Tov, Mahmood Sharif

arXiv:2606.23496v1Jun 22, 2026cs.LGcs.CR

TL;DR

Discrete optimizers remain scattered across model-, objective-, and domain-specific codebases, making adoption and comparison difficult. TROPT unifies them in a modular framework, supporting ready-to-run recipes, cross-domain composition, and controlled comparisons, while demonstrating portability across applications.

Problem
Discrete optimizers are scattered across model-, objective-, and domain-specific codebases, limiting their adoption and adaptation to new domains, models, and objectives.
Method
TROPT unifies discrete text-trigger optimization through a modular interface combining models, objectives, optimizers, losses, and reusable recipes.
Results
TROPT provides 30+ ready-to-run recipes built from 15+ optimizers and 15+ losses, enabling controlled optimizer comparisons and cross-domain recipe porting.
Takeaways & Limitations
TROPT supports standardized benchmarking and adaptation of discrete optimizers across applications including safety auditing, robustness analysis, defenses, and interpretability.
Takeaways & Limitations
TROPT excludes ad-hoc RL-trained LLMs and agentic systems, while its optimizer comparison focuses on jailbreaks and comprehensive cross-domain benchmarking remains future work.

Abstract

from arXiv · show

Discrete text-trigger optimization -- searching for text sequences that, when ingested by a model, steer it toward a specified objective -- underpins model red-teaming (e.g., LLM jailbreaks), as well as auditing and interpretability. However, the current state of discrete optimizers hinders their adoption and progress. First, existing optimizers, when open-sourced at all, are scattered across research codebases tied to specific models, objectives, and problem domains. Second, optimizer variants proliferate, each requiring engineering overhead to use or extend, and remaining hard to compare head-to-head. Together, these raise the bar for adopting optimizers in existing or new domains, and for advancing them via new strategies. We address these gaps with TROPT, the first open-source framework that unifies discrete optimizers' execution and standardizes their development under a single interface. TROPT makes it easy to customize end-to-end optimization recipes by swapping any component -- models, objectives, and optimizers -- extending its reach across domains and new applications. TROPT currently ships with 30+ optimization recipes -- covering applications such as jailbreaking and probing model internals -- built from 15+ optimizers (spanning white-box to black-box access) and 15+ losses, from foundational to state-of-the-art methods. Demonstrating its utility, we leverage TROPT in several studies: (i) controlled, large-scale experiments comparing and enhancing optimization strategies for LLM jailbreaks, revealing potent-yet-underadopted techniques; and (ii) porting optimizers from one domain (e.g., LLM jailbreak) to new domains (e.g., corpus-poisoning embedding model). In all, TROPT significantly lowers the barrier to adopting and advancing discrete text optimization.

1 Introduction

Discrete text-trigger optimization supports model inspection and stress-testing, but fragmented, domain-specific implementations hinder adoption, adaptation, and optimizer progress. TROPT addresses these barriers with a modular framework unifying recipes, models, objectives, and optimizers across domains.

Text-trigger optimization searches for discrete token sequences that optimize an objective when inserted into model inputs, enabling research on inspecting and stress-testing text models.
Existing optimizers are scattered across isolated, domain-specific codebases and coupled to particular models or objectives, creating substantial engineering overhead for use and adaptation.This friction limits applications such as porting LLM-jailbreak optimizers to dense retrievers or modifying objectives for LLM auditing.
TROPT is an open-source modular framework that unifies discrete optimizer research and provides shared infrastructure for adopting and advancing optimization schemes across domains.Its goal is to reduce engineering barriers while making optimizers more accessible and adaptable, including for security evaluations.
Idiosyncratic implementations and nuanced algorithmic details also make it difficult to build reliably on existing optimizers and measure progress.The introduction notes that such details can qualitatively change downstream conclusions, including in the development of GCG (Zou et al., 2023).
TROPT provides 30+ ready-to-run recipes built from 15+ optimizers and 15+ losses, spanning white- and black-box model backends through one interface.The recipes cover LMs, encoders, classifiers, and other models and are invocable in a few lines (Fig. 1b; §3).
Its modularity lets users combine optimizers, models, and objectives to create recipes and transfer methods across domains, including corpus poisoning, prompt-injection evasion, and text-to-image prompt recovery.These applications include porting LLM jailbreaks to dense-retriever corpus poisoning and constructing universal triggers for prompt-injection classifiers (§4.3).

2 Background

Discrete text-trigger optimization searches for short text strings that minimize a loss for a neural text model, with applicable optimizers constrained by the model access available during optimization. Although discrete optimizers support diverse approaches and applications, fragmented implementations and unreliable comparisons hinder their adoption and advancement.

Setting: Text-trigger optimization searches for a short trigger inserted into predefined input templates to minimize a quantifiable loss against a neural text model.The formulation includes a target model, loss, inputs with prefixes, suffixes, and targets, and a feasible trigger set that may constrain length or vocabulary.
Setting: Different optimization settings expose different levels of model access, such as gradients or generated text only, which constrains the optimizers that can be applied.The loss may also score the trigger directly, for example through fluency, while targets may specify output prefixes or classes.
Strategies of Discrete Search Optimizers: Discrete search methods include gradient-based token flipping, black-box zero-order search, genetic algorithms, and surrogate-model approaches.These strategies treat the combinatorial search differently and span white-box to black-box optimization settings.
Applications of Discrete Search Optimizers: Discrete optimizers support applications including LLM jailbreaks (Zou et al., 2023, §4.1–4.2), adversarial text-classification examples (Guo et al., 2021, §4.3), corpus poisoning against dense retrievers (Zhong et al., 2023, §4.3), and security evaluation.Human exploration remains a strong but labor-intensive red-teaming baseline, while LLM-as-optimizer methods iteratively propose candidate inputs.
Hurdles in Discrete Search Optimizer Research: Research progress is hindered because advances spread slowly across domains and optimizer variants are difficult to compare reliably.Corpus-poisoning attacks against dense retrievers have limited uptake of LLM-jailbreak optimizer advances and often default to weaker methods despite sharing the underlying optimization problem.
Hurdles in Discrete Search Optimizer Research: These hurdles stem from fragmented, non-standardized codebases and substantial engineering demands when adapting optimizers across models, objectives, settings, or domains.The proliferation of variants makes it difficult to identify the best method for a context and to develop new optimizers.

3 TROPT

TROPT is an open-source modular framework that unifies discrete text optimization through interchangeable models, losses, optimizers, and input-target setups. It provides ready-to-run recipes while enabling users to compose applications, add objectives, and implement search algorithms with lower adoption and development barriers.

Recipe Hub and composition: The Recipe Hub hosts 38+ pre-configured recipes reproducing published methods in a single call, while custom recipes can be composed from existing components.This supports reproducing methods, porting optimizers across models or domains, changing losses, and varying input templates.
Framework design: TROPT assembles models, losses, optimizers, and input-target setups into executable recipes for discrete optimization applications including attacks and model auditing.Each component can be swapped largely independently, while backend–frontend separation keeps model-specific infrastructure separate from lightweight loss and optimizer implementations.
Accessibility and comparability: By standardizing infrastructure and isolating component-specific logic, TROPT makes optimizers accessible across supported model types and compatible objectives while facilitating controlled component comparisons.The framework re-implements existing optimizers under tested infrastructure, allowing recipes to run out of the box and new variants to be evaluated by changing one component.
Losses: TROPT’s 16 losses operate on logits, output embeddings, attention scores, and LM-as-a-judge outputs, with a meta-loss supporting weighted combinations.Losses consume standardized model signals and remain agnostic to the target model; custom losses can therefore drop into compatible recipes, including activation-direction objectives such as the refusal direction (Arditi et al., 2024).
Optimizers: TROPT’s 17 optimizers span foundational methods such as HotFlip (Ebrahimi et al., 2018) and GCG (Zou et al., 2023), GCG improvements, continuous-relaxation methods, and black-box optimizers.Each optimizer is a self-contained standardized module focused on search logic, enabling readability, comparability, modification, and testing across models and objectives.

4 Evaluations

TROPT enables controlled comparisons of discrete optimizers and jailbreak recipe enhancements, while also supporting adaptations across domains and model types. Evaluations identify stronger and underadopted optimization strategies, more potent target-based enhancements, and successful cross-domain applications.

4.1 Optimizer Comparison: ∼5/14, PAL’s gradient-free counterpart matches white-box GCG and is the strongest black-box optimizer, while HotFlip, continuous-relaxation methods, and beam-search variants trail other optimizers.The comparison evaluates optimizer potency through response-token-forcing loss-minimization efficiency under a shared LLM recipe, using mean ranks across models and a Nemenyi critical difference of CD=1.48 at α=0.05.
4.1 Optimizer Comparison: The evaluations motivate tracking optimizer progress and adopting methods such as MAC and PAL in security benchmarks and LLM red-teaming.Optimizer potency may vary with model type and input domain, which this comparison holds fixed by using LLM jailbreaks.
4.2 Jailbreak Enhancements: Replacing the target string with responses or logits from a jailbroken target model roughly doubles Base median suffix universality, whereas loss modifications yield only modest gains.The compared enhancements each modify one aspect of a generic Base recipe, with universality distributions shown in Figure 3.
4.3 Cross-Domain Adaptation: TROPT supports successful optimizer adaptations across domains and model types, including a black-box LLM-jailbreak optimizer repurposed for corpus poisoning against OpenAI’s proprietary embedding model.In the corpus-poisoning recipe, ten adversarial passages in an 8M-passage retrieval corpus carry optimized triggers; GASLITE uses cosine similarity, while black-box optimization uses adapted random search.

5 Conclusion

TROPT unifies the execution and development of discrete text-trigger optimizers, reducing engineering overhead that has siloed techniques and obscured comparisons. It supports research across applications while remaining scoped to direct discrete search for neural text models.

Conclusion: TROPT is introduced as an open-source framework for running and developing discrete text-trigger optimization strategies across domains.Its central insight is that discrete optimizers solve the same algorithmic problem, while engineering overhead has kept them siloed and hindered comparison.
Conclusion: TROPT is intended to democratize discrete optimizers, standardize progress tracking through benchmarks, accelerate adaptive attacks and new strategies, and advance defensive NLP research.The authors intend to continue extending TROPT as the field evolves.
Research Directions: Pre-configured recipes support safety auditing, robustness analysis, defenses, and interpretability across language models, embedding models, and classifiers.TROPT’s adaptability also lowers the barrier to forming stronger red-team adversaries through adaptive objectives and optimizers transferred across domains.
Limitations: TROPT targets direct discrete search optimizers for neural text models, excluding ad-hoc reinforcement-learning-trained LLMs and LLM-based agentic systems.Its optimizer comparison focuses on jailbreaks, although the framework enables broader evaluation across domains such as embedding models.

Ethical Considerations … C TROPT Component Catalog

The paper addresses responsible release, broad applications, and implementation of TROPT, presenting it as a modular framework whose catalog and standardized interfaces support reusable optimization research.

Ethical Considerations: TROPT’s release recognizes misuse risks and reports disclosure of the framework and enabled attacks to affected model providers beforehand.The framework consolidates methods previously used to attack widely deployed LLMs, dense retrievers, and text classifiers.
Ethical Considerations: Because TROPT re-implements published methods that attackers could reconstruct, its marginal attacker uplift is limited relative to its substantial benefit for defenders conducting security evaluations.The paper also notes that LLM-based coding tools make reconstruction and combination easier.
Ethical Considerations: TROPT democratizes potent, up-to-date optimizers so researchers can evaluate robustness against adaptive attacks, reduce false confidence from weak evaluations, and develop defenses.The paper supports this rationale with prior security findings on weak or non-adaptive attack evaluations (Carlini et al., 2019; Nasr et al., 2025).
Ethical Considerations: Beyond red-teaming, TROPT supports toxicity auditing, memorization studies, model-internal probing, prompt recovery, adversarial training, and backdoor detection or extraction.These applications span both analytical uses and defensive applications.
A Related Work: Discrete search optimizers have expanded across research directions, including inference-time attacks against text classifiers and LLM jailbreaks, including adaptive variants.The related-work discussion frames these as prominent applications following the rise of powerful neural text models.
B TROPT: Additional Details: TROPT’s component design supports concise custom loss and optimizer implementations, with a quickstart notebook enabling immediate experimentation.The paper points to Code 2 and Code 3 as minimal demonstrations of these implementations.
B TROPT: Additional Details: A custom loss can consume standardized hidden-state outputs, measure last-layer, last-token alignment with a direction, and plug into any recipe without other code changes.The example requires hidden-state computation and minimizes alignment with a refusal direction to steer away from it.
C TROPT Component Catalog: TROPT’s component catalog organizes selected Recipe Hub recipes, optimization algorithms, and loss functions across Tables 1–3.Table 1 lists recipes, Table 2 details optimization algorithms, and Table 3 describes loss functions.

D Reproducing GCG with TROPT

TROPT faithfully reproduces GCG behavior under matched conditions, achieving comparable final loss to NanoGCG while completing the same runs substantially faster. The comparison uses 45 paired tasks on Gemma-3-12B-it with identical original GCG hyperparameters.

Setup: The head-to-head validation targets Gemma-3-12B-it on 15 ClearHarm harmful instructions across three seeds, producing 45 paired instruction-seed tasks per implementation.Both implementations use 500 optimization steps, 512 candidates per step, top-256 token sampling, and one token replacement per step.
Implementation: TROPT’s efficiency advantage is partly attributable to avoiding NanoGCG’s repeated torch.cuda.empty_cache() calls during dynamic batching.TROPT also batches dynamically while avoiding this runtime overhead.
Results: 2.5× faster runs and comparable final loss distinguish TROPT from NanoGCG: TROPT reaches 0.597 ± 0.384 versus 0.633 ± 0.335, surpassing NanoGCG on 25/45 tasks.The comparison covers the same 500-step GCG runs under matched hyperparameters.

E Benchmarking Optimization Strategies: Additional Details and Results · E.1 Detailed Setup

This section supplements the benchmarking study with a standardized evaluation recipe and detailed instantiations for white-box and black-box optimizers. All methods use a 20-token randomly initialized trigger, PrefillCE loss, constrained tokenization, and a shared 3 × 10^17 FLOP budget unless their procedures finish earlier.

E Benchmarking Optimization Strategies: Additional Details and Results: The section extends §4.1 with additional experimental-setup details and supplementary result analyses.
E.1 Detailed Setup: All optimizers use PrefillCE against dataset target responses, a randomly initialized T = 20 trigger, disabled non-ASCII and special tokens, and a 3 × 10^17 FLOP limit.Runs continue until the FLOP limit is exhausted unless an optimizer finishes earlier.
E.1 Detailed Setup: HotFlip, AutoPrompt, GBDA, ARCA, and PEZ instantiate gradient-based, candidate-sampling, relaxation, and discrete-projection optimization variants with algorithm-specific hyperparameters.AutoPrompt and ARCA use 512 candidates from top-256 token ids per position; ARCA averages gradients over 32 samples, while PEZ uses learning rate 0.1 and weight decay 0.1.
E.1 Detailed Setup: GCG, MAC, GASLITE, and PAL represent gradient-guided extensions using candidate sampling, momentum, multi-coordinate flips, gradient averaging, or proxy-guided targeting.GCG uses 512 candidates and top-256 sampling; MAC adds μ = 0.6 momentum; GASLITE averages 10 gradients and takes 7 flips per step; PAL uses 128 candidates.
E.1 Detailed Setup: RAL and Random Search provide black-box alternatives based on random candidate selection or block-random mutation with retokenization filtering.RAL uses 32 random candidates per step, while Random Search creates 128 candidates per step and resets the trigger after 50 stagnant steps.
E.1 Detailed Setup: BEAST, QCG, and AdvDecoding evaluate black-box search through beam sampling, random token flips, or auxiliary-language-model next-token distributions.BEAST uses beam size 15 and branching 15; QCG samples 1024 candidates while maintaining 128 best triggers; AdvDecoding uses Gemma 2 2B IT with beam size 96, branching 10, and top-k = 10.

E.2 Additional Results

Additional analyses confirm statistically significant differences among optimizers across 180 tasks and characterize their per-model loss, BLEU, jailbreak success, and optimization trajectories. The BLEU-based optimizer ordering strongly agrees with the loss-based ranking, while the figures report variability across seeds and instructions.

Per-Model Metrics: Per-model mean best loss, BLEU, and jailbreak success are reported for each optimizer, with variability measured across seeds and instructions.Loss is lower-is-better, BLEU is higher-is-better, and jailbreak success is scored with StrongReject-Finetuned (Souly et al., 2024) on responses to optimized jailbreak prompts.
Per-Model Metrics: BLEU-based optimizer ordering strongly correlates with the loss-based Mean Rank (Spearman’s ρ = −0.96), with higher BLEU and lower loss preferred.Figure 7 reports per-model mean BLEU, while Figure 6 reports absolute per-model mean best loss on a log scale; both aggregate across models and show standard deviations across seeds and instructions.
Optimizer Loss Curves: Per-model optimizer loss trajectories are tracked across the full FLOP budget, with shaded regions representing standard deviation across three seeds.These curves provide an optimization-dynamics view in addition to the final per-model metrics.

F Comparing Jailbreak Enhancements: Additional Details and Results · F.1 Detailed Setup

This section extends the jailbreak-enhancement evaluation with detailed setup and supplementary analyses, isolating each enhancement by modifying a fixed Base recipe. The evaluation targets Gemma-3-12B-it across 45 runs and measures trigger universality on held-out ClearHarm instructions.

F.1 Detailed Setup: Each jailbreak enhancement is evaluated in isolation by altering a fixed Base recipe, enabling its individual contribution to jailbreak performance to be tested.The Base recipe is fixed for the experiment, while each enhancement modifies it separately.
F Comparing Jailbreak Enhancements: Additional Details and Results: Figure 8 reports per-model mean jailbreak success for optimized prompts under each optimizer on StrongReject-Finetuned (Souly et al., 2024), with higher success preferred.The optimizer ordering correlates with the loss-based Mean Rank in Fig. 2, with Spearman’s ρ = −0.88.
F Comparing Jailbreak Enhancements: Additional Details and Results: Figure 9 shows optimizer loss curves across target models for one template, with shaded regions representing standard deviation across seeds.
F.1 Detailed Setup: The Base recipe uses the MAC optimizer, PrefillCE loss, an optimized trigger appended as a suffix, and default dataset target strings.This recipe mirrors the optimizer-evaluation recipe in Appendix E, except that the MAC optimizer is fixed.
F.1 Detailed Setup: The evaluated variants include replacing PrefillCE with the Carlini-Wagner loss, which has been adopted in jailbreak settings (Carlini and Wagner, 2017; Sitawarin et al., 2024; Hayase et al., 2024).
F.1 Detailed Setup: The setup also considers organic targets generated by an abliterated jailbroken model and a jailbroken-model teacher loss based on logits distillation.The abliterated model generates 20 tokens for optimization, while prior work suggests organic targets may be preferable to generic ones (Zhu et al., 2024).
F.1 Detailed Setup: 45 runs evaluate each enhancement variant on Gemma-3-12B-it, using 15 harmful instructions and 3 random seeds sampled from ClearHarm.The instruction and target string are randomly sampled, similarly to the data used in §4.1.
F.1 Detailed Setup: Trigger universality is measured on 100 held-out ClearHarm harmful instructions by appending each trigger, generating responses on Gemma-3-12B-it, and applying StrongReject.

F.2 Additional Results · G Cross-Domain Generalization: Additional Details

The extended jailbreak evaluation compares trigger-free baselines, single- and multi-instruction optimization, and enhancement combinations. It finds that the template drives most baseline success, multi-instruction optimization selectively helps some losses, and Attn-Hijack consistently improves certain variants, while also providing additional setup details for the cross-domain demonstration.

F.2 Additional Results: The extended evaluation adds bare-instruction and handcrafted-template controls, repeats the analysis with one trigger optimized across multiple instructions, and tests combinations of enhancements.The full results are reported in Figure 10 alongside the main-body results.
F.2 Additional Results: 82% universality from the jailbreak template versus 2% from bare harmful instructions shows that the template drives substantial baseline jailbreak success, leaving negligible improvement for optimized triggers.These are trigger-free controls included in the extended comparison.
F.2 Additional Results: Multi-instruction optimization generally increases universality, but its benefits vary across enhancements and substantially improve losses such as CE-Clamping and CW over their single-instruction baselines.CE-Clamping and CW show negligible single-instruction improvements over baseline but significant gains with multi-instruction optimization.
F.2 Additional Results: Adding the Attn-Hijack loss consistently improves universality for both the jailbroken-target and jailbreak-template variants.Combining enhancements otherwise does not drastically increase universality.
F.2 Additional Results: Figure 10 reports jailbreak-universality distributions for individual and combined enhancements in both single-instruction and multi-instruction settings.The multi-instruction setting optimizes one trigger across all training instructions per run, whereas the single-instruction setting uses one trigger per instruction.
G Cross-Domain Generalization: Additional Details: The cross-domain generalization appendix provides additional experimental-setup details for the demonstration described in §4.3.The supplied passage identifies the section’s purpose but does not specify further setup components.

G.1 Corpus Poisoning Against Dense Retrievers · G.2 A Universal Trigger for Evading a Prompt-Injection Classifier · G.3 Prompt Recovery for Text-to-Image Models

TROPT extends discrete text optimization to corpus poisoning, universal prompt-injection evasion, and prompt recovery for text-to-image models, while supporting reusable optimizer composition. These applications demonstrate both practical attack effectiveness and cross-domain portability.

G.1 Corpus Poisoning Against Dense Retrievers: TROPT implements corpus poisoning by optimizing malicious adversarial passages that are retrieved among the top results for targeted queries.The method targets textual dense embedding retrievers used for semantic search and retrieval-augmented generation.
G.1 Corpus Poisoning Against Dense Retrievers: The corpus-poisoning setup indexes MSMARCO with FAISS and evaluates retrieval with either malicious passages alone or passages containing optimized triggers.GASLITE is used when gradients are available, while Random Search is used for models without gradient access.
G.1 Corpus Poisoning Against Dense Retrievers: 72%–76% of held-out queries retrieved an adversarial passage in the top 10 after inserting only 10 passages into an 8M-sized corpus.The attack targeted the Harry Potter concept and succeeded on both dense retriever models.
G.2 A Universal Trigger for Evading a Prompt-Injection Classifier: TROPT optimizes a single universal trigger that flips a prompt-injection classifier’s prediction from INJECTION to BENIGN across varied injection messages.The setup uses GCG, the BENIGN-class cross-entropy loss, and multi-sample resampling of input templates following Wallace et al. (2019).
G.2 A Universal Trigger for Evading a Prompt-Injection Classifier: The evaluated prompt-injection evasion trigger is: RequestprovidedPrevious floormonthincl4.98 odd feedbackDescription2254catId All CampusGroupName $(siologis||0 Station/04/2017.
G.3 Prompt Recovery for Text-to-Image Models: TROPT recovers discrete prompts whose CLIP text embeddings match source-image embeddings, then regenerates images with a text-to-image model.The experiments use GCG and a CLIP image-similarity loss with Stable Diffusion 2.1 and the laion/CLIP-ViT-H-14-laion2B-s32B-b79K encoder; Table 4 sweeps T ∈{5, 10, 15, 20} on two images.
G.3 Prompt Recovery for Text-to-Image Models: TROPT lets custom optimizers define a self-contained search loop while delegating model-compatible loss computation and framework-managed tracking, enabling composition with compatible components.The illustrated random-search optimizer declares token-level loss access, samples candidates, retains the best loss, and logs steps through trackers such as Wandb.