Source-linked AI summary
Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search
Shiliang Xiao, Jingsong Wei, Yuzhi Liang, Yufan Zheng, Xia Li, Qiliang Lin
TL;DR
Existing GCG-based jailbreak optimization can over-focus on easy behaviors and spend its budget along greedy trajectories that miss promising suffixes. BOSS combines TFAL, source loss, and behavior coverage with multiple short trajectories and selective continuation; experiments report improved attack success rates, reduced optimization time, and higher target-response consistency. Transferability remains uncertain when source and target models differ substantially.
Problem
Existing GCG-based methods rely on averaged adversarial loss and deep greedy search, which can under-attend harder behaviors and overlook promising suffix-space regions.
Method
BOSS is a plug-and-play framework that uses TFAL, standard source loss, and behavior coverage while reallocating optimization from deep greedy search to multiple short trajectories with selective continuation.
Results
Experiments on public benchmarks show higher attack success rates across multiple GCG-based methods, reduced optimization time, and higher target-response consistency.
Takeaways & Limitations
Broad suffix exploration and source-side diagnostics are effective design principles for transferable jailbreak optimization within the evaluated setting.
Takeaways & Limitations
Transferability remains uncertain when source and target models differ substantially in architecture, training data, alignment procedure, or refusal behavior.
Abstract
from arXiv · showhide
Optimization-based jailbreak attacks such as Greedy Coordinate Gradient (GCG) achieve strong effectiveness and transferability by optimizing adversarial suffixes on white-box source models. However, existing GCG-based methods rely on averaged adversarial loss and deep greedy search, which can over-emphasize easy-to-jailbreak behaviors and overlook promising regions of the suffix space. We propose BOSS, a plug-and-play framework that improves GCG-based jailbreak optimization through breadth-oriented suffix search. BOSS uses Tail-Focused Adversarial Loss (TFAL), standard source loss, and behavior coverage to select terminal suffixes, then explores multiple short trajectories and selectively continues promising suffixes. Experiments on public benchmarks show that BOSS improves attack success rates across multiple GCG-based methods while reducing optimization time.
1 Introduction
Existing GCG-based jailbreak methods can waste optimization effort on already easy behaviors and follow greedy suffix trajectories that miss better regions. BOSS addresses both issues with hard-behavior-focused selection and breadth-oriented search.
- Optimization-based jailbreak attacks append adversarial suffixes and update them with source-model gradients, offering strong effectiveness and transferability.
- Averaged adversarial loss can keep prioritizing easy behaviors because target-sequence loss remains nonzero even after successful jailbreaks.Harder behaviors may therefore receive insufficient optimization attention.
- Deep greedy search can miss promising suffix-space regions because the lowest-current-loss suffix need not lead to the best final suffix.Figure 1 illustrates this mismatch between selected suffixes and suffixes with lower attainable adversarial losses.
- BOSS introduces Tail-Focused Adversarial Loss and combines it with standard source loss and behavior coverage for suffix selection.The framework is designed as a plug-and-play improvement for GCG-based jailbreak optimization.
- BOSS reallocates computation from deep greedy trajectories to multiple short trajectories and selectively continues promising suffixes.This broadens the explored suffix pool while preserving compatibility with existing GCG-based methods.
- Experiments on public benchmarks report higher attack success rates and less running time after integrating BOSS into multiple GCG-based algorithms.
2 Related Work
Related work develops gradient-guided suffix attacks and broader search strategies, while BOSS applies budget allocation within source-model suffix optimization. Its search retains multiple terminals, selectively continues parents, and chooses the final suffix before target evaluation.
- GCG adapts gradient-guided discrete trigger search by appending adversarial suffixes and updating tokens toward an affirmative target response.
- Recent suffix attacks modify objectives, templates, initialization, candidate construction, refusal suppression, response constraints, or insertion positions.
- Standard discrete suffix optimization evaluates many substitutions but usually continues only selected incumbent suffixes, discarding other candidates before their later value is tested.
- Beam search, random search, Bayesian optimization, and resource-allocation methods retain or allocate budget across multiple hypotheses or configurations.
- Multi-start and random-search jailbreak attacks introduce more initial states, whereas BOSS allocates search budget within source-model suffix optimization.
- BOSS runs short trajectories, retains terminal suffixes, selects parents with source-side diagnostics, continues them, and chooses the final suffix before target-model evaluation.
3 Problem Setup
The problem setup optimizes one discrete adversarial suffix on a white-box source model across training harmful behaviors. Each behavior is scored by the source model’s negative log-likelihood for an affirmative response prefix, averaged into the source loss.
- The setup optimizes a single adversarial suffix on a white-box source model.
- Training harmful behaviors are denoted by Xtr, the source model by Ms, and each suffix z has length L with tokens from vocabulary V.
- The prompt constructor Φ(x, z) combines a harmful behavior x with suffix z as the model input.
- For each behavior, y(x) is an affirmative response-prefix token sequence, while y<r(x) denotes tokens preceding position r.
- Per-behavior source loss is the source model’s negative log-likelihood of the affirmative response prefix conditioned on the constructed prompt and preceding response tokens.
- The source loss averages this per-behavior objective over the training harmful behaviors.
4 Method
BOSS embeds the base GCG local optimizer in a breadth-oriented procedure that builds multiple terminal suffixes, selects promising parents with source-side diagnostics, and continues them before final selection. Behavior coverage gates parent eligibility, while standard source loss and TFAL rank candidates before target evaluation.
- Base Optimization and Initial Suffix Pool: The base optimizer proposes coordinate-token replacements with gradients, evaluates candidate suffixes using full source loss, and updates one incumbent suffix per step.The resulting incumbent sequence is a trajectory, and its fixed-step endpoint is a terminal suffix.
- Base Optimization and Initial Suffix Pool: BOSS constructs an initial suffix pool by running the base optimizer multiple times, with independent randomness controlling each optimization run.Each run is short and contributes its terminal suffix to the initial pool.
- Parent Selection with Source-Side Diagnostics: Behavior coverage gates parent eligibility by measuring the fraction of training harmful behaviors whose per-behavior loss meets a source-loss threshold.The gate helps preserve broad attack coverage during parent selection.
- Parent Selection with Source-Side Diagnostics: TFAL evaluates the highest-loss fraction of harmful behaviors, while source loss and TFAL provide source-side diagnostics for ranking terminal suffixes.The hard-behavior subset is defined by the largest per-behavior source losses, and both diagnostics are derived from those losses.
- Parent Selection with Source-Side Diagnostics: BOSS ranks coverage-eligible suffixes with normalized source-loss and TFAL signals, selects K parents, continues them, and chooses the final suffix from A1 ∪A2.If too few suffixes pass the coverage gate, the remaining parent slots are filled from the ineligible suffixes using the same score.
5 Experiments
Experiments on HarmBench evaluate BOSS across GCG-based baselines, source and target models, attack success, search time, and target-response consistency. BOSS generally improves attack effectiveness and response consistency while reducing wall-clock optimization time through staged, breadth-oriented suffix search.
- Experimental Setup: Experiments use HarmBench with 20 training behaviors and 200 test behaviors, evaluating source- and target-model ASR across seven target models.ASR is measured with HarmBench-Llama-2-13B-cls over three random seeds; Llama-2-7B-Chat and Yi-1.5-9B-Chat serve as source models.
- Method: BOSS combines multiple short optimization trajectories, selective parent continuation, behavior coverage, standard source loss, and TFAL for parent and final suffix selection.The default configuration uses N = 10 initial runs, T1 = 30 update steps, K = 4 parents, and T2 = 50 continuation steps within 500 total iterations.
- Ablation: 87.5%: on Yi-1.5-9B-Chat with GJO, full BOSS reaches average T-ASR of 87.5%, exceeding w/ parents at 59.2% and w/ final at 73.3%.The comparison indicates that applying behavior coverage and TFAL to both parent and final suffix selection outperforms using them at only one stage.
- Efficiency: More than half: BOSS reduces wall-clock search time on Llama-2-7B-Chat from 471 to 195 minutes for GCG, 410 to 172 for I-GCG, and 340 to 166 for GJO.The fixed total update budget is reallocated from one long incumbent trajectory to broader exploration followed by selective continuation.
- Target-Response Consistency: BOSS generally increases average target-model BERTScore-F1 and produces more consistent target-response patterns across models after transfer.Examples include 53.78 to 72.94 on Qwen2-7B-Instruct with I-GCG and 38.60 to 52.16 on GPT-3.5-Turbo with GCG.
6 Conclusion
BOSS improves GCG-based jailbreak optimization by reallocating search from depth to breadth and using source-side diagnostics for suffix selection. Experiments show higher attack success rates, reduced optimization time, and greater target-response consistency.
- 6 Conclusion: BOSS explores multiple short suffix trajectories and selectively continues promising terminal suffixes instead of relying on deep greedy search.This reallocates the optimization budget from depth to breadth.
- 6 Conclusion: Tail-Focused Adversarial Loss emphasizes hard-to-optimize behaviors and is combined with standard source loss and behavior coverage for terminal suffix selection.
- 6 Conclusion: BOSS improves attack success rates across multiple GCG-based methods on HarmBench.
- 6 Conclusion: BOSS reduces optimization time and produces responses with higher target-response consistency.
Limitations
BOSS selects suffixes primarily with source-side diagnostics in the standard white-box transfer setting, but source-target differences make transferability uncertain.
- Limitations: BOSS uses source loss, TFAL, and behavior coverage to select parent suffixes and the final suffix.
- Limitations: Source-side diagnostics may fail to predict target-model effectiveness when source and target models differ substantially.Relevant differences include architecture, training data, alignment procedure, or refusal behavior.
- Limitations: Future work could incorporate explicit transferability objectives while avoiding target-test leakage.
Ethical Considerations
The work frames jailbreak suffix optimization as dual-use and positions the evaluation for controlled red-teaming and safety assessment. It limits target-model use to post-selection evaluation and recommends safeguards in practice.
- Ethical Considerations: The study treats jailbreak suffix optimization as inherently dual-use and aims to support controlled red-teaming and safety evaluation.
- Ethical Considerations: Target models are queried only after final suffix selection rather than serving as optimization feedback.
- Ethical Considerations: Practical evaluations should occur only in authorized settings with safeguards for model access, logging, and disclosure.
- Ethical Considerations: The paper reports aggregate metrics and limited qualitative examples while avoiding complete operational instructions.
A Prompt
The suffix-evaluation prompt places the optimized adversarial prompt before the behavior question and follows it with a fixed target-response prefix. Figure 5 presents this input template schematically with redacted placeholders.
- A Prompt: The optimized adversarial prompt is placed before the behavior question in the suffix-evaluation template.
- A Prompt: A fixed target-response prefix follows the behavior question.
- A Prompt: Figure 5 shows a schematic example using redacted placeholders.
B Additional Implementation Details
The implementation specifies fixed settings for gradient proposals, hard-behavior selection, and the weighting of source and hard-behavior losses.
- The gradient proposal set size is κ = 256.
- The hard-behavior fraction in Lhard(z) is qh = 0.5.
- The source-loss and hard-behavior-loss weights are λs = 0.45 and λh = 0.20, respectively.
C Additional Results with Yi as Source Model
When suffixes are optimized on Yi-1.5-9B-Chat, BOSS improves source-model and target-model ASR across GCG, I-GCG, and GJO.
- With BOSS, source-model ASR increases for GCG from 70.5% to 81.0%, I-GCG from 23.5% to 78.5%, and GJO from 71.5% to 72.5%.
- Target-model average ASR increases with BOSS for GCG from 43.1% to 63.4%, I-GCG from 28.1% to 59.8%, and GJO from 46.2% to 60.0%.
- Table 4 reports ASR for the Yi-1.5-9B-Chat source model with Base and +Ours results for GCG, I-GCG, and GJO.