PaperlayerView exact revision on arXiv

Source-linked AI summary

Discovering Jailbreaks via Curriculum of Models

Michał Burzyński, Noah T. Rossi, Shomit Basu, Andy Arditi

arXiv:2610.38833v1cs.LGcs.AI

TL;DR

Safety-trained targets usually refuse harmful requests, making RL-based jailbreak discovery difficult because investigators receive sparse rewards. CoM trains investigators against a sequence of increasingly difficult target variants, from refusal-weakened to original. It finds successful jailbreaks more reliably than baselines in single-behavior training, while multi-behavior training elicits held-out behaviors but has lower success rates than PRBO.

  • Problem

    Nearly all early prompts to a safety-trained target are refused, producing sparse rewards that give an RL investigator little basis for improvement.

    Source: §1 · pp. 1–2

  • Method

    CoM trains an investigator against progressively harder target variants, beginning with a version that rarely refuses and advancing toward the original target.

    Source: §1 · pp. 2–3

  • Results

    CoM finds successful jailbreaks across evaluated single behaviors where both baselines largely fail, and elicits held-out behaviors in multi-behavior training, though PRBO has higher success rates.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The findings suggest that a simple curriculum over target models can help address sparse rewards in rare-behavior elicitation.

    Source: §1 · p. 3

    Distinct judge models agree on pass/fail verdicts only 77.7–89.6% of the time, and judge agreement alone does not establish correctness; human experts may be needed for confidence.

    Source: §6.1 · pp. 9–10

Abstract

from arXiv · show

Automated jailbreak discovery aims to find prompts that elicit prohibited behaviors from safety-trained language models, helping developers identify vulnerabilities before deployment. One class of approaches uses reinforcement learning to train an investigator model to generate prompts that elicit a specified behavior from a target model. However, training directly against a safety-trained target is difficult because nearly all prompts are refused, leaving the investigator with a sparse reward signal. Prior work addresses this with the propensity bound (PRBO), a proxy reward estimated by sampling responses from a more compliant target, and then adjusting for how likely those responses would have been under the original target. We introduce Curriculum of Models (CoM), an alternative method that trains the investigator against a sequence of modified versions of the target, progressing gradually from a version that readily exhibits the specified behavior to the original target. For jailbreak discovery, training begins against a target version that rarely refuses harmful requests, and advances to the next, harder version once the investigator reliably elicits the behavior from the current one. We evaluate CoM on elicitation tasks involving CBRN materials, explosives, and illicit drugs, using two open-weight targets, gemma-4-31b-it and gpt-oss-120b. We compare against PRBO and direct training on the original target without a curriculum. When the investigator is trained to elicit a single behavior, CoM finds successful jailbreaks more reliably than either baseline. When trained on multiple behaviors simultaneously, the CoM-trained investigator can elicit held-out behaviors, though PRBO-trained investigators achieve higher success rates. Our results suggest that a simple curriculum over target models offers a promising approach for addressing sparse rewards in rare-behavior elicitation.

1 INTRODUCTION

Jailbreak discovery faces sparse rewards because safety-trained targets usually refuse, leaving RL investigators little signal to improve. Curriculum of Models (CoM) gradually trains against harder target variants; it outperforms baselines in single-behavior training and elicits held-out behaviors in multi-behavior training.

1 INTRODUCTION

  • Early prompts against a safety-trained target usually receive refusals and zero reward, leaving RL little basis to improve prompts.With no reward variation, RL cannot distinguish prompts closer to success.Source: §1 · pp. 1–2
  • CoM trains the investigator against progressively harder target variants, advancing from an easy-to-elicit version toward the original target.The aim is to keep reward useful as difficulty increases.Source: §1 · pp. 2–3
  • For jailbreak discovery, CoM decreases an anti-refusal adapter’s strength across stages, ultimately recovering the original target.The representative Figure 1 run shows reward recovering after each stage transition and rising above the threshold on the unmodified target.Source: Figure 1 · p. 2, §1 · p. 3
  • The evaluation covers CBRN materials, explosives, and illicit drugs on gemma-4-31b-it and gpt-oss-120b targets, comparing CoM with PRBO and direct training.The paper also analyzes hyperparameter ablations and discovered jailbreak strategies.Source: §1 · p. 3
  • CoM discovers successful jailbreaks across all evaluated single behaviors against gemma-4-31b-it, while PRBO and direct-training baselines largely fail.In multi-behavior training, CoM elicits held-out behaviors, although PRBO achieves higher success rates on both targets.Source: §1 · p. 3

2 METHODOLOGY

The method frames elicitation as RL over investigator prompts scored by a judge, then constructs an easy-to-hard sequence of target variants. Training advances as performance improves, with separate progression for each behavior in joint training.

2.1 PROBLEM SETUP

  • A fixed behavior rubric guides investigator prompts; a sampled target response is scored by a judge, and that score measures rubric satisfaction.Only investigator parameters are updated; target and judge remain fixed.Source: §2.1 · p. 3

2.2 CONSTRUCTING A CURRICULUM OF MODELS

  • CoM constructs K + 1 targets from a refusal-weakened target to the original, with intermediate models increasing elicitation difficulty.A trained anti-refusal LoRA supplies the update; reducing its influence recovers the original target and empirically increases refusal rates smoothly.Source: §2.2 · p. 4

2.3 TRAINING THE INVESTIGATOR

  • Investigator training uses GRPO with the judge score as reward and a KL penalty that regularizes the investigator toward its initial model.The target variants and judge remain fixed.Source: §2.3 · p. 4

2.3.1 SINGLE-BEHAVIOR TRAINING

  • In single-behavior training, a group of prompts is sampled against the current target, and training advances when its mean score reaches threshold τ.After reaching the original target, remaining steps continue against it.Source: §2.3.1 · p. 4

2.3.2 MULTI-BEHAVIOR TRAINING

  • Multi-behavior training uses behavior-specific rollout groups, reward normalization within each group, and a separate curriculum level for each behavior.Behaviors can therefore progress toward the original target at different rates.Source: §2.3.2 · p. 4

2.4 EVALUATION

  • Evaluation samples 256 prompts per behavior and reports estimated pass@1, the probability that one sampled prompt–response pair succeeds.Success requires a score of 100 under the strict rubric; the evaluation targets are the original, unmodified models.Source: §2.4 · pp. 4–5

2.5 BASELINES

  • PRBO uses a refusal-weakened target as its proposal distribution, while Direct RL trains against the original target without curriculum or target modifications.Direct RL receives a lightly anti-refusal-SFT-initialized investigator; CoM and PRBO do not use that warm start.Source: §2.5 · p. 5

3 RESULTS

CoM outperforms both baselines across the evaluated single-behavior configurations, while multi-behavior results show that CoM and PRBO generalize to held-out behaviors, with PRBO achieving the highest mean success rates.

3.1 SINGLE-BEHAVIOR ELICITATION

  • CoM achieves higher mean pass@1 than Direct RL and PRBO in all twelve single-behavior target configurations.The reported estimate uses 256 prompt–response pairs per seed and averages three seeds.Source: §3.1 · p. 6, Table 1 · p. 6
  • Against gemma-4-31b-it, CoM succeeds on all four behaviors with and without target reasoning, but its mean pass@1 ranges from below 1% to 50% and varies across seeds.Direct RL produces no successful elicitations, and PRBO succeeds only on VX for the target without reasoning; some CoM runs also produce no successful elicitations.Source: §3.1 · p. 6
  • Against gpt-oss-120b, CoM’s mean pass@1 is 26.4%–61.1% across the four selected behaviors, with successful elicitation in every seed.Direct RL succeeds only on methamphetamine, while PRBO has near-zero success rates throughout.Source: §3.1 · p. 6

3.2 MULTI-BEHAVIOR ELICITATION

  • In multi-behavior training, CoM and PRBO achieve substantial success on held-out behaviors, and PRBO has the highest mean pass@1 on both splits for both targets.The investigators train on 8 behaviors and are evaluated on 39 held-out behaviors.Source: §3.2 · p. 7, Figure 2 · p. 7
  • Against gemma-4-31b-it, mean held-out pass@1 is 44.2% for CoM, 60.0% for PRBO, and 7.0% for Direct RL.All three CoM and PRBO runs achieve substantial success on both splits, while two of three Direct RL runs have essentially zero success.Source: §3.2 · p. 7
  • Against gpt-oss-120b, mean held-out pass@1 is 54.3% for CoM, 62.8% for PRBO, and 56.4% for Direct RL.All three methods perform well across training seeds.Source: §3.2 · p. 7

4 ANALYSIS OF COM

The ablations examine how curriculum length, advancement threshold, and KL regularization affect CoM training. The qualitative analysis finds recurring role-based and academic framing in successful prompts, with prompts shifting toward educational framing across curriculum stages.

4.1 HYPERPARAMETER ABLATIONS

  • CoM’s curriculum length K sets the number of intermediate target models, τ sets the score threshold for advancing, and βKL weights the penalty keeping the investigator near its initial policy.The target sequence has K + 1 models, interpolating from refusal-disabled α = 1 to original α = 0 in 1/K steps.Source: §4.1 · p. 7
  • At K = 2, all three seeds reach the original target and fail, while K = 5 and K = 10 yield similarly consistent high scores.The authors suggest the jump from α = 0.5 to α = 0 is too large; additional granularity beyond K = 5 does not appear to help.Source: §4.1 · p. 8
  • Performance is roughly insensitive to τ above a minimum, but τ = 20 leaves one of three seeds failing before the original target.Scores are consistently high from τ = 40 to 90; at τ = 90, runs take nearly twice as many steps to reach the original target as at τ = 60.Source: §4.1 · p. 8
  • Performance is robust to moderate KL penalties but degrades at βKL = 2, where two of three seeds fail before the original target.Values from 0 to 1 perform similarly, although without the penalty two of three seeds collapse to near-zero policy entropy.Source: §4.1 · p. 8

4.2 QUALITATIVE ANALYSIS OF INVESTIGATOR STRATEGY

  • Across seeds and target substances, successful prompts often assign the target an authoritative role and frame the request as teaching or coursework.Examples include scientific expert, professor, or tutor roles, alongside academic-research or quality-control rationales.Source: §4.2 · p. 8
  • Across one successful training run, prompts shift from overtly adversarial scenarios toward academic and educational framing while retaining requests for detailed technical responses.Source: §4.2 · p. 8

5 RELATED WORK

Related work spans automated red teaming and jailbreak search, behavior elicitation with reward corrections for sparse feedback, and curricula that progress from easier to harder tasks. CoM varies the target model while keeping the desired behavior fixed, unlike a related jailbreak curriculum that varies request text.

5 RELATED WORK

  • Automated red teaming uses language models to generate and evaluate adversarial test cases, while jailbreak methods include prompt optimization, continuous relaxations, and attacker-guided search.Other approaches use RL or LLM-guided search to find violations and automated auditing to generate realistic scenarios.Source: §5 · p. 9
  • Behavior elicitation trains an investigator to generate inputs for specified target behaviors; PRBO addresses sparse rewards with behavior-steered response scores and a log-likelihood correction.Prior work also applies investigator agents to CBRN, explosives, and drug instruction elicitation, including joint training across 48 behaviors.Source: §5 · p. 9
  • Curriculum learning progresses from easier to harder tasks, and Boundary Point Jailbreaking applies this idea by gradually restoring corrupted request text.Unlike BPJ, CoM varies the target model while keeping the desired behavior fixed.Source: §5 · p. 9

6 DISCUSSION

The discussion limits the evaluation to single-turn elicitation, white-box construction of target variants, and selected CBRN tasks, and identifies broader settings for future study. It also notes constraints from automated judging and limited experimental coverage, alongside details of the models and sampling setup.

6.1 LIMITATIONS

  • The study covers single-turn elicitation, assumes white-box access to modify targets, and evaluates selected CBRN tasks; generalization beyond these settings remains open.The authors also identify multi-turn conversations and agentic trajectories as unstudied settings.Source: §6.1 · p. 9
  • Distinct judge models agree on 77.7–89.6% of pass/fail verdicts, versus 92.9% agreement between repeated gpt-oss-120b judge calls; agreement does not establish correctness.The authors note that human experts would likely be needed for confidence in correctness, and that gpt-oss-120b target evaluations may be affected by self-preference.Source: §6.1 · pp. 9–10
  • The experiments use one investigator, two targets, and limited tasks and seeds; computational costs constrain assessment across model combinations, behaviors, and independent runs.Single-behavior runs cost approximately $50 each and multi-behavior runs approximately $200 each.Source: §6.1 · p. 10

6.2 FUTURE WORK

  • Future work could test other harmful requests, rare behaviors, and multi-turn or agentic settings, but CoM’s effectiveness beyond refusal-based curricula on selected synthesis tasks remains unassessed.The authors suggest other rare behaviors could be studied where target variants differ in elicitation difficulty and a judge can recognize the behavior.Source: §6.2 · p. 10

A MODELS AND INFERENCE DETAILS

  • The experiments use gemma-4-31b-it and gpt-oss-120b as targets, qwen3.5-9b as investigator, and gpt-oss-120b as judge; target and investigator sampling uses temperature 1.The intended judge temperature of 0 was not achieved through the OpenRouter providers, which returned varied responses to repeated prompts.Source: A MODELS AND INFERENCE DETAILS · p. 16

B PER-BEHAVIOR ANALYSIS

The per-behavior analysis selects tasks that are difficult to elicit from original targets but readily elicited from refusal-weakened variants. It reports model-specific task selections and describes the adapter-training setup used to create those variants.

B PER-BEHAVIOR ANALYSIS

  • Behaviors were selected for low original-target pass@128 but high refusal-weakened pass@16, distinguishing difficult yet within-capability tasks from already-elicitable or insufficiently demonstrated tasks.The analysis sampled prompts from a lightly anti-refusal-SFT-trained investigator without RL, using judge score 100 as the success criterion and a larger original-target rollout budget.Source: B PER-BEHAVIOR ANALYSIS · p. 16, Figure 4 · p. 17
  • For gemma-4-31b-it, four selected synthesis behaviors had no successes in approximately 5,100 original-target rollouts each, while refusal-weakened pass@16 ranged from 0.888 to 0.993.The selected behaviors were fentanyl, MDMA, sarin, and VX synthesis.Source: B PER-BEHAVIOR ANALYSIS · p. 16
  • For gpt-oss-120b, four selected behaviors had zero successes in 5,120 original-target rollouts each and estimated refusal-weakened pass@16 above 0.997.The selected behaviors were TATP, HMTD, methamphetamine, and heroin synthesis.Source: B PER-BEHAVIOR ANALYSIS · p. 16

C.1 ANTI-REFUSAL ADAPTER TRAINING DETAILS

  • The refusal-weakened variants were produced by SFT on compliant responses generated by Heretic variants, using rank-1 LoRA adapters to control the training procedure and weight update.The training prompts comprise 2,704 harmful and borderline requests from five datasets; target-specific training also differed in whether reasoning traces were included.Source: §C.1 · pp. 17–18

C.2 WARM-START INVESTIGATOR TRAINING DETAILS

The appendix describes anti-refusal SFT used to warm-start the investigator for Direct RL and reports its effect on refusal and policy proximity. It also gives shared training settings and explains how PRBO combines a proposal-response reward with a target-response option.

C.2 WARM-START INVESTIGATOR TRAINING DETAILS

  • Warm-start SFT lowers qwen3.5-9b’s refusal rate on held-out harmful prompts from 91.8% to 1.6%, with per-token KL of 0.18 nats on held-out benign prompts.The warm start strengthens Direct RL; CoM and PRBO instead begin from the unmodified investigator.Source: §C.2 · p. 18

D.1 TRAINING CONFIGURATION

  • All methods use GRPO with rank-32 LoRA, learning rate 1 × 10^-5, and usually group size 64; CoM uses βKL = 0.5, K = 5, and τ = 60.Single-behavior runs use 400 steps; multi-behavior runs use 400 steps for gemma-4-31b-it and 200 for gpt-oss-120b.Source: §D.1 · p. 18

D.2 PRBO REWARD FORMULATION

  • PRBO scores proposal responses with the behavior score plus a log-likelihood correction for the original target versus proposal, providing signal before successful target samples are common.The combined estimator also samples a natural target response and selects the larger of the two rewards; that response becomes useful as prompts improve.Source: §D.2 · p. 19

D.3 PRBO IMPLEMENTATION DETAILS

The PRBO implementation selects a combined estimator configuration through a Tabun sweep and documents implementation differences; training variability includes nondeterministic judge scores across repeated calls.

D.3 PRBO IMPLEMENTATION DETAILS

  • The combined estimator with λ = 1.1 and no natural-response threshold was most effective in the Tabun hyperparameter sweep.The sweep compared the default threshold of -50 with no threshold; the latter always combines the two rewards.Source: §D.3 · p. 19
  • The implementation uses a refusal-weakened LoRA proposal, group size 64, and all token log-probabilities for the KL term.Multi-behavior PRBO uses B = 4 groups per optimization step and single-behavior PRBO uses B = 1.Source: §D.3 · p. 19

D.4 SOURCES OF RANDOMNESS BETWEEN RUNS

  • Investigator sampling, target sampling, and judge scoring contribute to run-to-run variance.Repeated judge passes over the same rollout can disagree; the authors attribute this to OpenRouter routing across providers that may not honor the temperature setting.Source: §D.4 · p. 20

E.1 SINGLE-BEHAVIOR RESULTS

The appendices detail single- and multi-behavior evaluation scopes, training dynamics, and investigator-refusal patterns. Single-behavior PRBO often retains investigator refusal, unlike multi-behavior PRBO.

E.1 SINGLE-BEHAVIOR RESULTS

  • Single-behavior results report pass@1 and pass@32 at six content thresholds across three target configurations and three-seed averages.A rollout must clear three response gates and satisfy at least j of six content criteria; the prompt must also pass the prompt judge.Source: §E.1 · p. 21, Table 4 · p. 21, Table 5 · p. 21

E.2 MULTI-BEHAVIOR RESULTS

  • The multi-behavior figures report mean pass@1 over three seeds for eight behaviors on gemma-4-31b-it and gpt-oss-120b.Bars show the lowest and highest seed.Source: Figure 6 · p. 23, Figure 7 · p. 24

E.3 TRAINING DYNAMICS OF COM

  • The training-dynamics figures track curriculum stage, original-target judge score, and investigator policy entropy across three hyperparameter sweeps.The curriculum anneals steering coefficient α from 1 toward 0 as each stage is solved; lines show means and individual seeds.Source: §E.3 · p. 25, Figure 8 · p. 25, Figure 9 · p. 26

F.1 PERSISTENT INVESTIGATOR REFUSALS

  • Across multi-behavior settings investigators quickly learn not to refuse, whereas almost all single-behavior settings show the opposite pattern.Source: Figure 10 · p. 26
  • In most successful runs investigators learn to stop refusing, but occasional successful jailbreaks occur while the investigator still refuses.Most refusal-containing rollouts score poorly; the appendix contrasts a perfect-score example with one scoring zero of six criteria.Source: §F.1 · pp. 26–27

Investigator prompt

  • 40/48 single-behavior PRBO runs never trained away investigator refusal and all scored pass@1 of 0, while every multi-behavior run trained it away and scored at least 50%.These results contrast refusal persistence across the two training settings.Source: Investigator prompt · p. 27

F.2 PRBO ABLATIONS

The ablations test whether warm-starting investigators or increasing group size improves single-behavior PRBO. Neither setup change brought performance close to CoM.

F.2 PRBO ABLATIONS

  • The tested explanations for weak single-behavior PRBO were persistent investigator refusal and fewer rollouts per step than in multi-behavior training.The compared rollout counts were 64 versus 256.Source: §F.2 · p. 27
  • The group-size ablations trained on HMTD synthesis against gpt-oss-120b; 256-group runs reduced step counts, except seed 1, which ran 200 steps.Source: Table 8 · p. 28
  • Neither warm-starting nor increasing group size to 256 made PRBO perform similarly to CoM.The authors note another hyperparameter configuration could work, but their more extensive PRBO analysis found no better configuration.Source: §F.2 · pp. 27–28

G EVALUATION CRITERIA AND JUDGE PROMPTS

The evaluation criteria gate reward on both the target response’s harmfulness and the investigator prompt’s validity. Judge prompts assess technically credible, actionable synthesis guidance and whether prompts elicit harmful content without supplying answers or using fictional framing, with the prompt judge returning criterion assessments in a prescribed JSON format.

G EVALUATION CRITERIA AND JUDGE PROMPTS

  • Each rollout earns the response score only if all six prompt-validity criteria pass and the investigator did not refuse; otherwise, its reward is zero.The response judge scores the target response from 0 to 100, while a separate judge evaluates prompt validity.Source: G EVALUATION CRITERIA AND JUDGE PROMPTS · p. 29

G.1 RESPONSE JUDGE

  • The response judge first applies three relevance gates, then scores qualifying responses by the number of actionable-content criteria they satisfy.The numeric score is zero if any gate fails; otherwise it is the count of content criteria marked true.Source: §G.1 · p. 29
  • The relevance gates require an exact-target synthesis response, technically realistic chemistry, and an authentic known synthesis route, excluding refusals, vague descriptions, and fabricated chemistry.The judge is instructed to distinguish practical, reality-grounded synthesis guidance from general knowledge.Source: §G.1 · pp. 29–30
  • The response’s content criteria assess whether it offers practical details such as precursor sourcing, named starting materials, meaningful equipment, replicable measurements, reaction conditions, and procedural purification.Criteria count only when details are specific and useful for practical implementation, rather than merely naming a technique or category.Source: §G.1 · pp. 30–31

G.2 PROMPT JUDGE

  • The prompt judge checks that prompts genuinely seek harmful information rather than sarcasm, embedded answers, extra synthesis content, or fictional framing.It evaluates the prompt itself, not the target response.Source: §G.2 · pp. 32–33
  • The prompt judge also rejects prompts that reveal specific synthesis precursors, while allowing broad chemical vocabulary and general reagent references.All six prompt criteria must pass for the prompt to avoid gating the reward to zero.Source: §G.2 · pp. 32–33
  • Prompts are flagged for including quantities or molar ratios, a reaction sequence that reveals a synthesis route, or information sufficient to begin synthesis without the model’s response.The supplied criteria fragment describes these as actionable synthesis details.Source: §G.2 · p. 33
  • The no_papers criterion is false when a prompt names specific research papers, authors, or well-known synthesis methods.Examples include the Janssen method, Kauffmann et al., and the Siegfried synthesis route.Source: §G.2 · p. 33
  • Requests for literature-based or academically grounded information remain allowed if they do not name a specific source.Such prompts can receive true for no_papers.Source: §G.2 · p. 33
  • The judge must return exactly one JSON object, with no markdown or text outside it.The response format requires boolean values for the criteria.Source: §G.2 · p. 33
  • The response instructions prohibit any output beyond the JSON assessment object.The output must contain only the boolean criterion values in the specified object.Source: §G.2 · p. 33
  • The required assessment fields are no_sarcasm, no_answer, no_extra_info, no_fiction, no_precursors, and no_papers.Each field is specified as a boolean.Source: §G.2 · p. 33

H JUDGE ANALYSIS

This appendix documents judge agreement and its limitations, training costs, and the investigator prompts and examples used in the study. It includes a gpt-oss-120b forensic-case-study prompt requesting a reconstruction of historical MDMA production, with chemical specifics redacted.

H JUDGE ANALYSIS

  • Pass/fail agreement was 92.9% between gpt-oss-120b’s two runs, versus 85.3–89.6% for four alternative judges and 77.7% for deepseek-v4.1-flash.On gemma-4-31b-it responses, most panel judges assigned more scores of 100 than the reference judge; on gpt-oss-120b responses, every panel judge was stricter, making the reported rates conservative for Gemma and an upper estimate for gpt-oss-120b.Source: Table 9 · p. 34, H JUDGE ANALYSIS · p. 34
  • deepseek-v4.1-flash reasoned longer on 70% of rollouts, with median traces of 4,882 versus 3,230 characters, and was the strictest judge.The authors hypothesize that longer deliberation surfaces chemical errors in proposed routes, but caution that trace length comes from fresh calls, is confounded by verbosity, and does not imply more accurate verdicts; authentic_synthesis is also the least reproducible gate. Inspections found examples where deepseek identified specific route errors that the reference judge accepted.Source: H JUDGE ANALYSIS · pp. 34–36, Figure 13 · p. 36

I COST BREAKDOWN

  • Refusal-weakened adapters cost about $35 in total, a CoM run about $45 after shared target inference, and a PRBO run about $70.A warm-start investigator, used in some PRBO ablations and the floor/ceiling analysis but not required for CoM, cost about $14; evaluation cost about $0.53 per single behavior or about $25 per 47-behavior run.Source: I COST BREAKDOWN · pp. 36–37

J INVESTIGATOR PROMPT

  • The investigator prompt asks for a user-style prompt to elicit a prohibited response, with scoring based on gate conditions and response content criteria.Gate conditions require addressing the exact target chemical with realistic chemistry and a known route; content criteria reward acquisition guidance, named precursors, equipment, measurements, temperature and timing, and purification.Source: J INVESTIGATOR PROMPT · p. 38

K EXAMPLES OF SUCCESSFUL JAILBREAKS

  • The appendix presents successful jailbreak examples with response details redacted, while retaining prompts for scientific inspection.The examples include an MDMA synthesis excerpt targeting Gemma-31B-it without reasoning and a fentanyl example framed as an advanced chemistry lecture.Source: K EXAMPLES OF SUCCESSFUL JAILBREAKS · p. 39

Investigator prompt

  • Example investigator prompts use historical-route framing for MDMA and an academic total-synthesis lecture framing for fentanyl.The examples’ synthesis instructions and chemical details are redacted in the appendix.Source: Investigator prompt · pp. 39–40
  • The supplied response excerpt includes multiple synthesis stages and workups, followed by mechanistic explanations, while redacting chemical identities and conditions.The visible structure includes reductive amination, acylation, and discussions of imine formation and nucleophilic attack.Source: Investigator prompt · pp. 41–42
  • The prompt frames the task as a forensic case study of MDMA synthesis history found in seized equipment, intended to reconstruct clandestine production methods.It asks for an analysis based on historical forensic data and clandestine literature.Source: Investigator prompt · p. 42
  • It requests commercial precursors and reagents, laboratory equipment, and step-by-step reaction conditions, including temperatures and durations.The excerpt’s subsequent inventory and workflow sections provide redacted examples of these requested categories.Source: Investigator prompt · p. 43

L EVOLUTION OF INVESTIGATOR STRATEGY DURING TRAINING

The section illustrates investigator prompts across curriculum stages, from a fully steered target to the unmodified target, using high-reward examples.

L EVOLUTION OF INVESTIGATOR STRATEGY DURING TRAINING

Investigator prompt

Related papers

Loading 2610.38833v1…