Enhancing the Transferability of Jailbreak Attacks on Large Language Models via Exploiting Reparameterization Invariance (2026.acl-long)
Copied to clipboard
| Challenge: | Existing token-level attacks have shown efficacy on open-source models but suffer from poor cross-model transferability. |
| Approach: | They propose a framework to improve cross-model transferability by modifying model parameters and generating update directions according to differences in output distributions rather than parameter-space distances. |
| Outcome: | The proposed framework improves cross-model transferability and success rates on open-source models. |
Similar Papers
Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints (2025.acl-long)
Copied to clipboard
| Challenge: | Jailbreaking attacks can effectively induce unsafe behaviors in Large Language Models (LLMs). |
| Approach: | They propose a conceptual framework to elucidate transferability of gradient-based jailbreaking methods . they identify superfluous constraints as significant barriers to improved transferability . |
| Outcome: | The proposed method increases the overall transfer attack success rate (T-ASR) across target and source models with varying safety levels from 18.4% to 50.3% while improving stability and controllability of jailbreak behaviors. |
Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models (2025.coling-main)
Copied to clipboard
| Challenge: | Despite advances in training Large Language Models, they remain vulnerable to jailbreak, an adversarial attack method. |
| Approach: | They propose an adversarial jailbreak algorithm that exploits the gradient information of the suffix tokens to accelerate the optimization process. |
| Outcome: | The proposed model achieves 1.5x speedup while maintaining high attack success rates. |
Activation-Guided Local Editing for Jailbreaking Attacks (2026.acl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking Large Language Models (LLMs) are limited and produce incoherent or unreadable inputs. |
| Approach: | They propose a two-stage framework that performs a one-shot, scenario-based generation of context and rephrases the original malicious query to obscure its harmful intent. |
| Outcome: | The proposed framework achieves state-of-the-art Attack Success Rate, with gains of up to 37.74% over the strongest baseline, and excellent transferability to black-box and large-scale models. |
CAVGAN: Unifying Jailbreak and Defense of LLMs via Generative Adversarial Attacks on their Internal Representations (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have isolated LLM jailbreak attacks and defenses . a new framework combines attack and defense to protect against malicious queries . |
| Approach: | They propose a framework that combines attack and defense to protect the Large Language Model (LLM) by embedding harmful problems into the safe area. |
| Outcome: | The proposed framework achieves an average jailbreak success rate of 88.85% across three popular LLMs while the defense success rate reaches an average of 84.17%. |
Rewrite to Jailbreak: Discover Learnable and Transferable Implicit Harmfulness Instruction (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak methods create a forced instruction-following scenario, or search adversarial prompts with prefix or suffix tokens to achieve a specific representation manually or automatically. |
| Approach: | They propose a method that rewrites the original instruction to achieve a jailbreak . they propose rewriting the original instructions to improve the attack strategy . |
| Outcome: | The proposed method is more efficient and easier to identify since no additional features are introduced. |
Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities (2025.naacl-long)
Copied to clipboard
Chung-En Sun, Xiaodong Liu, Weiwei Yang, Tsui-Wei Weng, Hao Cheng, Aidan San, Michel Galley, Jianfeng Gao
| Challenge: | Recent research shows that Large Language Models (LLMs) are vulnerable to automated jailbreak attacks. |
| Approach: | They propose a framework that crafts adversarial LLMs with enhanced jailbreak ability. |
| Outcome: | ADV-LLM significantly reduces the computational cost of generating adversarial suffixes while achieving nearly 100% ASR on various open-source LLMs. |
Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Understanding how jailbreaking works remains limited, hindering the development of effective defense strategies. |
| Approach: | They propose a new mechanism that adaptively constrains activations within the safety boundary and propose 'Activation Boundary Defense' to enhance its effectiveness. |
| Outcome: | The proposed defense achieves an average Defense Success Rate (DSR) of over 98% against various jailbreak attacks, with less than 2% impact on the model’s general capabilities. |
JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models (2026.findings-acl)
Copied to clipboard
Qingjia Huang, Jingyu Zhang, Jianguo Wu, Yakai Li, Weijuan Zhang, Yankai Rong, Junyi Yao, Shengzhi Zhang, Xiaoqi Jia
| Challenge: | Currently, evaluation criteria and methods used for jailbreak effectiveness are inconsistent. |
| Approach: | They propose a framework to measure jailbreak effectiveness using a model that filters out jailbreak noise while preserving the original malicious question. |
| Outcome: | The proposed framework outperforms existing evaluation methods on a challenging benchmark containing 330 human-labeled, non-rejected jailbreak instances. |
SafeInt: Shielding Large Language Models from Jailbreak Attacks via Safety-Aware Representation Intervention (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Jailbreak attacks exploit vulnerabilities in large language models to induce undesirable behavior . existing defenses cannot dynamically adjust representations based on harmfulness of queries . |
| Approach: | They propose a representation-aware representation method that shields LLMs from jailbreak attacks . SafeInt relocates jailbreak-related representations into the rejection region . |
| Outcome: | The proposed method outperforms baseline defenses while maintaining utility . it relocates jailbreak-related representations into the rejection region . |
Diversity Helps Jailbreak Large Language Models (2025.naacl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking large language models rely on laborious human engineering and whitebox access to model internals. |
| Approach: | They propose a method that instructs large language models to deviate from prior context and generate harmful outputs by instructing them to deviat from previous attacks. |
| Outcome: | The proposed method achieves a 62.83% higher success rate in compromising ten leading chatbots, while using only 12.9% of the queries. |