Source-linked AI summary
Controlled Decoding Attacks on Black-Box LLMs
Jesson Wang, Shawn Li, Wei Yang, Franck Dernoncourt, Ryan A. Rossi, Charith Peris, Yue Zhao
TL;DR
Decoding-time control can bypass language-model safety alignment, but existing approaches rely on target weights or numerical probabilities unavailable through sampled-text interfaces, where finite sampling is also costly. BLINDBIAS reconstructs distributions from samples and selectively applies residual control, with speculative drafts reducing repeated target calls. Across four endpoints and three benchmarks, it achieves the highest mean score in most comparisons against baselines.
Problem
Decoding-time control requires target weights or numerical token probabilities, while sample-only interfaces yield sparse, noisy estimates and make per-step reconstruction costly.
Source: §1 · p. 1Method
BLINDBIAS reconstructs next-action distributions from sampled continuations, gates residual control by response-prefix risk, and verifies draft prefixes to reduce repeated target calls.
Source: §1 · pp. 2–3Results
BLINDBIAS achieved the highest mean score in 20 of 24 comparisons against four prompt-level baselines, across Harm and Info, using a fixed configuration with a separately trained controller for each target.
Source: §1 · p. 2, §4.3 · p. 9Takeaways & Limitations
Experiments across four targets and three benchmarks provide evidence that sampled outputs can support effective distributional control, while selective intervention trades attack effectiveness for less frequent controller invocation.
Source: §1 · p. 2, §5 · p. 10Draft verification does not imply distribution preservation or token-for-token equivalence with repeated single-token API calls.
Source: §2 · p. 4
Abstract
from arXiv · showhide
Manipulating next-token probabilities during generation can bypass the safety alignment of large language models. Existing approaches, however, rely on access to model weights or numerical token probabilities and therefore do not apply to interfaces that return only sampled text. Reconstructing probabilities from sampled outputs offers a possible alternative, but finite sampling produces sparse and noisy estimates, while repeating this process at every generation step incurs substantial query costs. Our empirical observations suggest that large distributional changes along successful jailbreak trajectories are concentrated at a small subset of positions, motivating selective control. We introduce \method{}, a framework for jailbreaking through text-only continuation interfaces that permit repeated sampling and assistant-prefix continuation. Sample-Based Distribution Reconstruction combines sampled outputs with a prior over unobserved actions to obtain a usable control signal. Risk-Gated Residual Control uses the evolving response prefix to decide when to reconstruct and modify the distribution, concentrating sampling costs at selected positions. Speculative Multi-Token Execution further amortizes target calls by verifying and accepting draft prefixes that require no intervention. Across four target endpoints and three benchmarks, \method{} achieves the highest mean score most comparisons against baselines.
1 INTRODUCTION
BLINDBIAS extends decoding-time control to text-only continuation interfaces, where sampled text can be used but target weights and numerical probabilities are unavailable. It combines distribution reconstruction with prefix-dependent intervention and draft verification to manage sampling and query costs.
1 INTRODUCTION
- Decoding-time control can steer an aligned model at each generation step, but direct application requires target weights or numerical token probabilities.This access requirement leaves sampled-text interfaces outside the direct setting of those methods.Source: §1 · p. 1
- Finite samples yield sparse, noisy distribution estimates, while reconstructing at every generation step incurs substantial query costs.This tension motivates concentrating estimation and intervention at selected positions.Source: §1 · pp. 1–2
- Large next-token distribution changes occur at only a few positions along successful jailbreak trajectories, motivating selective control rather than per-step estimation.The approach conditions intervention on the evolving prefix rather than relying only on a fixed opening window.Source: §1 · p. 2
- BLINDBIAS combines sampled-action distribution reconstruction, prefix-gated residual control, and speculative multi-token execution for text-only continuation interfaces.The framework assumes an attacker-supplied assistant prefix and maps returned text into a local tokenizer vocabulary.Source: §1 · pp. 2–3
- The paper evaluates BLINDBIAS on four target endpoints and three benchmarks, examining reconstruction priors, intervention frequency, prior transfer, and an exploratory string-based action space.The evaluation also analyzes reconstruction quality and the trade-off between attack effectiveness and intervention frequency.Source: §1 · pp. 2–3
2 RELATED WORK
Related work spans prompt-level jailbreaks, decoding-time control, and research on selective intervention and efficient execution. BLINDBIAS differs by adapting residual control to sampled-text access, while its draft verification enforces a gate rule without guaranteeing distribution preservation or token-for-token equivalence.
2 RELATED WORK
- Prompt-level jailbreaks use prompt search, template evolution, multi-turn interaction, or encoded instructions, whereas BLINDBIAS additionally assumes repeated stochastic sampling and assistant-prefix continuation.Examples include PAIR and TAP [Chao et al., 2023; Mehrotra et al., 2023], GPTFuzzer, and Crescendo [Russinovich et al., 2024].Source: §2 · p. 3
- Prior decoding-time methods steer frozen models through distributional changes, and JULI uses BiasNet with target log-probabilities; BLINDBIAS adapts residual control to sampled text.The main setting uses a local tokenizer to define the action vocabulary.Source: §2 · p. 3
- Evidence of shallow alignment motivates selective intervention, but does not establish that a fixed initial window suffices; BLINDBIAS can reactivate its gate later in generation.Its speculative path uses the remote target for drafts and a local risk model to verify whether each prefix permits bypassing the controller.Source: §2 · p. 3
- Draft verification enforces the gate rule on accepted prefixes, but does not imply distribution preservation or token-for-token equivalence with repeated single-token API calls.This distinguishes the method's verification rule from classical speculative decoding's target-distribution preservation guarantee.Source: §2 · pp. 3–4
3 PROPOSED METHOD
BLINDBIAS adapts decoding-time control to text-only continuation interfaces by reconstructing next-action distributions from samples and selectively applying a learned residual. Its method adds risk-gated intervention, speculative execution, and an empirical string-action extension.
3 PROPOSED METHOD
- BLINDBIAS assumes repeated sampled continuations and attacker-supplied assistant prefixes, with local actions mapping returned text to an action vocabulary without access to target weights or probabilities.The workflow combines reconstruction, residual control, and speculative execution.Source: §3 · p. 4
3.1 SAMPLE-BASED DISTRIBUTION RECONSTRUCTION
- Sample-based reconstruction estimates next-action probabilities from K sampled continuations and combines observed counts with a global-uniform prior that assigns mass to unobserved actions.The same estimator constructs training-cache and inference-time inputs; the prior is independent of the prompt and prefix.Source: §3.1 · pp. 4–5
3.2 RISK-GATED RESIDUAL CONTROL
- Risk-Gated Residual Control scores the deterministic base candidate appended to the evolving prefix, then scales BiasNet’s residual and runs reconstruction only when the scale exceeds its cutoff.Warm-up uses full residual strength; when the scale is zero, the base action is accepted without additional samples.Source: §3.2 · pp. 5–6
3.3 SPECULATIVE MULTI-TOKEN EXECUTION
- Speculative execution drafts multiple tokens after consecutive zero-scale steps, verifies draft prefixes with the same gate, and commits the longest prefix that stays below the cutoff.A violating action and the remaining draft are discarded; multi-token requests may produce different candidates from repeated single-action calls, even at zero temperature.Source: §3.3 · p. 7
3.4 EXTENSION TO AN EMPIRICAL STRING ACTION SPACE
- The empirical string-action extension builds actions from target-returned strings and reference-answer strings, then combines their counts with a proxy prior without using target token IDs or a target tokenizer.It cannot emit strings absent from calibration and uses only the first proxy token for possibly multi-token strings, making it an approximate vocabulary-free transfer stress test.Source: §3.4 · p. 8
4 EXPERIMENTS
Experiments evaluate BLINDBIAS on three harmful-request benchmarks using Harm and Info scores, compare it with prompt-level attacks, and analyze reconstruction, prior transfer, and selective gating.
4.1 DATASETS AND EVALUATION METRICS
- The evaluation uses AdvBench, HarmBench, and SORRY-Bench, with Harm Score and Harm Info Score assigned by Gemini-3.5-Flash.The benchmarks contain 520, 320, and 440 harmful-request examples, respectively; higher scores indicate greater attack effectiveness.Source: §4.1 · p. 8
4.4 ABLATION STUDIES AND ANALYSIS
- Under soft versus hard gating, active positions fall from 9.5% to 5.25% and API calls decrease by 36.8%.Compared with ungated control, average API calls fall from 4,000 to 283 (92.9%), while Harm Score decreases from 3.96 to 3.58; active-position frequency alone does not establish endpoint query savings.Source: Table 4 · p. 9, §4.4 · p. 10
4.2 IMPLEMENTATION DETAILS
- The study evaluates four target endpoints against PAIR, GPTFuzz, LogiBreak, and FlipAttack, with target decoding generally set to temperature 0 and top-p = 1.BLINDBIAS generation disables response caching and rejects hidden reasoning tokens; its base requests use temperature 0 and top-p = 1.Source: §4.2 · p. 9
4.3 MAIN RESULTS
- BLINDBIAS achieves the highest mean score in 20 of 24 comparisons against four prompt-level baselines.The reported gains span both Harm and Info.Source: §4.3 · p. 9
- BLINDBIAS leads both metrics on all three Gemini-3.5-Flash benchmarks, but FlipAttack leads both metrics on GLM-5 SORRY-Bench.On SORRY-Bench, BLINDBIAS improves over the strongest baseline by 1.86 Harm points and 1.19 Info points.Source: §4.3 · p. 9
- On Kimi-K2.5 AdvBench, LogiBreak scores higher on Harm while BLINDBIAS scores higher on Info; on Qwen3-32B HarmBench, BLINDBIAS leads Harm while PAIR leads Info.The reported attack rankings differ across targets and evaluation criteria.Source: §4.3 · p. 9
4.4 ABLATION STUDIES AND ANALYSIS
- The uniform prior lowers PPL from 11.85 to 7.07 and raises Harm/Info from 1.50/1.26 to 3.03/2.16; the unigram prior fits better but yields lower attack scores.The comparison includes smoothed empirical counts, a uniform prior, a global unigram prior, and numerical log probabilities as a reference.Source: §4.4 · pp. 9–10
- Same-family contextual priors perform best on all three metrics, while both cross-family proxies improve Harm over the shuffled control and only Gemma also improves Info.Nearly identical PPL values nevertheless correspond to different attack scores.Source: §4.4 · p. 10
5 CONCLUSION
BLINDBIAS demonstrates the feasibility of sample-only distributional control, while highlighting costs and interface assumptions that remain.
5 CONCLUSION
- Across four targets and three benchmarks, sampled outputs support effective distributional control, while selective intervention trades attack effectiveness for less frequent controller invocation.The conclusion identifies endpoint-level query efficiency and reliable control beyond tokenizer-based action spaces as remaining challenges.Source: §5 · p. 10
A.1 EVALUATION METRICS
The appendix defines the two evaluator scores used to assess attack effectiveness.
A.1 EVALUATION METRICS
- Harm Score measures response harmfulness and facilitation of the input intent, while Harm Info Score measures the amount and informativeness of harmful content.Higher scores indicate stronger attack effectiveness under each criterion.Source: §A.1 · p. 14
A.2 IMPLEMENTATION DETAILS
Implementation uses target-specific local tokenizers and a fixed BLINDBIAS configuration, with training and inference performed around text-only target calls.
A.2 IMPLEMENTATION DETAILS
- Local tokenizers define action IDs, the reconstruction vocabulary, and decoded text appended to the response prefix; Gemini outputs use Gemma-tokenizer coordinates.Those local tokens need not coincide with Gemini’s internal tokens.Source: §A.2 · p. 14
- Main-result rows use soft-gated training and inference with a global-uniform prior, K = 50 sampled actions, and a symmetric Dirichlet prior of strength κ = 2.The prior strength is selected by held-out sample NLL, and invalid or empty responses are refilled until 50 valid samples are collected or retries are exhausted.Source: §A.2 · p. 14
- BiasNet is trained for 10 epochs on cached answer prefixes, while inference uses the same soft scale and activates speculation after two consecutive bypassed positions.The configuration uses a local Llama-3.1-8B-Instruct prefix-risk model, a three-token full-strength warm-up, and a maximum draft length of 80.Source: §A.2 · p. 14
- A target call returns only text; action mapping, prefix scoring, distribution reconstruction, and BiasNet application occur locally.The call is conditioned on the user prompt and committed assistant prefix.Source: §A.2 · p. 14
A.3 ADDITIONAL ANALYSES
The additional analyses use a cached set of records and a fixed AdvBench evaluation set to examine diagnostics for Qwen3-32B.
A.3 ADDITIONAL ANALYSES
- Diagnostics use a 40-record LLM-LAT cache and a fixed set of 100 AdvBench prompts with Qwen3-32B as the target.AdvBench prompts are reserved for evaluation.Source: §A.3 · p. 14
- Token selection is greedy conditional on the reconstructed distribution, while reconstruction remains stochastic because samples are drawn at temperature 1.Source: §A.3 · p. 14
- The diagnostics use the cached records and fixed evaluation prompts unless otherwise stated.Source: §A.3 · p. 14
A.3.1 RECONSTRUCTION DIAGNOSTICS
The reconstruction diagnostics describe the prior-based baseline, the gated decoding procedure, and how predictive checks use sampled continuations.
A.3.1 RECONSTRUCTION DIAGNOSTICS
- The smoothed-count baseline applies additive smoothing to observed counts and assigns floor mass to unobserved actions.The uniform-prior condition uses Eq. equation 2, while the global unigram prior is estimated from the training cache.Source: §A.3.1 · p. 14
- At each step, the procedure uses the base action when the gate is zero; otherwise it reconstructs the distribution and selects an action using the BiasNet residual.After consecutive cutoff-based bypasses, speculative drafts are verified, accepted up to the first violation, and control resumes at the committed prefix.Source: §A.3.1 · p. 15
- Predictive diagnostics split 50 cached-prefix samples into calibration and held-out halves, while downstream generation uses all K = 50 samples.PPL uses held-out events and unseen NLL is restricted to events absent from calibration; these diagnostics and downstream attack scores measure different uses of the reconstructed distribution.Source: §A.3.1 · p. 15
A.3.2 CONTEXTUAL-PRIOR MAPPING AND CALIBRATION
The contextual-prior analyses vary proxy models and calibration, while gate-aware diagnostics describe classifier construction and limits on comparing training rules.
A.3.2 CONTEXTUAL-PRIOR MAPPING AND CALIBRATION
- The contextual-prior experiment holds the Qwen3-32B target and controller fixed while varying the proxy, including same-family and different-tokenizer models.Different-tokenizer proxies retokenize target-token strings and score them using their first proxy token; each proxy is temperature-calibrated on held-out sample events, with a shuffled prior as negative control.Source: §A.3.2 · pp. 15–16
A.3.3 GATE-AWARE TRAINING DIAGNOSTICS
- The prefix-risk classifier uses a frozen Llama-3.1-8B-Instruct backbone and a trainable classification head whose sigmoid gives the prefix risk score.The head operates on the last non-padding token representation; its training data use Guard-labeled prefixes with persistent unsafe labels after the detected boundary.Source: §A.3.3 · p. 16
- The classifier remains fixed during later BiasNet training and generation, while Eq. equation 4 applies hard-threshold and soft-scaling execution policies to its score.The retained checkpoint configuration does not preserve the original optimizer arguments or dataset size.Source: §A.3.3 · p. 16
- 14.0 to 29.0 is the increase in evaluation weight when the first three positions are added in Block B, alongside a lower average margin over the expanded support.The diagnostic describes broadened warm-up coverage, not an end-to-end performance gain; scores do not isolate training effects on common evaluation support.Source: §A.3.3 · p. 16
- Soft weighting in Block A yields a less negative margin and higher beats-base rate under its own evaluation weighting, but this also changes the evaluated support.Source: §A.3.3 · p. 16