{"id":"d28cbb13-80a8-4d2e-bd1f-6975cf48fc2b","arxiv_id":"2412.12621","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"REDA jailbreaks LLMs in one step by framing harmful requests as defensive tasks and using in-context examples, reporting high and transferable attack success rates.","lead":"This paper introduces REDA, a jailbreak technique that disguises harmful requests as defensive tasks, producing one-shot attack prompts that transfer across multiple LLMs. The reported attack success rates are high (84-99%), but the evaluation methodology, including output truncation and a black-box judge, deserves scrutiny before relying on the numbers.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"REDA's headline numbers rely on stripping its own '<COUNTERMEASURES>' section before judging while baselines are judged on full outputs; the SOTA comparison is not yet established.","rationale":"The paper is transparent about the post-processing, and the attack idea (embedding harmful content in a defensive framing) is coherent and likely partially effective; the ablation study shows EGE and RIM contribute. The most load-bearing assumption is that the two-step judge measures the same thing for REDA and for baselines. It does not, because Section 5.5 applies truncation only to REDA outputs. The unsound RIM derivation in Appendix B is a genuine flaw but not the decisive one: the RIM ablation gives empirical support for the declarative-form effect, whereas the evaluation asymmetry directly undermines every headline ASR and transfer number. The reader's conditional verdict already identifies this concern; I do not see a reason to move the verdict, provided the authors release outputs/code and re-run the comparison under a symmetric protocol. No code or data is released in the paper, so the numbers cannot currently be independently checked.","tokens_in":18452,"tokens_out":7320,"duration_ms":69770,"concrete_test":"Re-run the two-step evaluation (rejection-keyword filter plus Llama2-13b HarmBench referee) on the full, untruncated REDA responses for all seven models, including the transfer set, and recompute ASR/AQC and the Figure 4 transfer rates. As a symmetric control, also run the same two-step judge on baseline outputs with REDA's truncation rule applied after the first refusal-like sentence. If full-output REDA ASR drops materially (e.g., >5-10 points) or matches the truncated baseline ASR, the SOTA claim is an artifact of the asymmetric post-processing.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5.5 states that for REDA outputs, everything after '<COUNTERMEASURES>' is removed before the two-step judge, 'to prevent countermeasures from affecting the evaluation result.' Since REDA's own template forces the model to end with a countermeasures section, that is exactly where safety disclaimers and refusal-like phrasing are most likely to appear. Removing it before the rejection-keyword check and the HarmBench-style referee means REDA is scored only on the pre-countermeasure portion, while GCG, AutoDAN, GPTFuzzer, and DRA are scored on their complete responses. This asymmetry affects Tables 1, 4, 5, and the transferability results in Figure 4. The 'highest ASR / lowest AQC' and '96.20% transfer' claims therefore do not compare like with like; they show that the pre-countermeasure fragment passes the judge, not that REDA succeeds under the same standard as the baselines. The method may still work, but the headline comparison must be re-run under a symmetric protocol.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes REDA (Reverse Embedded Defense Attack), a black-box jailbreak method that constructs prompts through a template asking the target model to explain harmful content, give examples, and provide countermeasures, thereby framing generation as a defensive task. It adds in-context learning examples from a new 260-pair dataset across 13 categories, selected by Jaccard similarity, and converts interrogative test queries to declarative form (Request Intent Mitigation). The authors evaluate on four open-source and three closed-source models, reporting ASR, AQC, and AQT against GCG, AutoDAN, GPTFuzzer, and DRA. Their central claims are that REDA achieves the highest ASR and lowest AQC (one step) across all seven models, that its prompts transfer across models with an average success rate of 96.20%, and that declarative prompts are more likely to be answered than interrogative prompts, with a derivation in Appendix B.","tokens_in":18671,"tokens_out":7427,"duration_ms":63991,"significance":"If the results hold under a symmetric evaluation, the contribution is practically significant: REDA would be a one-shot, readable, model-transferable jailbreak that outperforms both gradient-based and black-box baselines on open- and closed-source models. The paper also contributes a jailbreak QA dataset and an ablation suggesting each component matters. The two-step judge is a reasonable attempt to reduce false positives. However, the headline ASR and transfer numbers currently rest on an asymmetric evaluation protocol that truncates REDA outputs only, and the Appendix B derivation assumes its conclusion; until these are addressed, the SOTA and 'one step is enough' claims are not established. The strengths of the paper include a clear method description, tests on seven models, and an explicit limitations section.","major_comments":[{"comment":"The evaluation protocol is asymmetric and the headline numbers depend on it. The paper states that for REDA, 'we additionally post-process the baseline model's output by removing \"<COUNTERMEASURES>\" and any subsequent content to prevent countermeasures from affecting the evaluation result,' while GCG, AutoDAN, GPTFuzzer, and DRA are judged on their full outputs by the two-step judge (rejection keywords plus the Llama2-13b referee). Because REDA's prompt template explicitly asks the model to end with countermeasures, that is precisely where refusal-like or disclaiming language would occur. Truncating only REDA outputs before the rejection-keyword check and referee therefore measures a pre-countermeasure fragment, not the same response property measured for baselines. This asymmetry affects the ASR/AQC values in Tables 1, 4, and 5 and the transferability numbers in Figure 4, including the 96.20% average transfer claim. The comparison should be rerun under a symmetric protocol, ideally reporting both full outputs for all methods and outputs truncated at the first structural delimiter for all methods; the 'same evaluation criteria' statement in Section 5.1 is contradicted by this post-processing.","section":"Section 5.5"},{"comment":"The derivation of PInt < PDec is circular. Equation (11) simply assumes that the per-token conditional probability ratio equals the corpus-frequency ratio lambda/mu, and since lambda < mu by the earlier assumption, Eq. (12) and Eq. (7) follow immediately. The appendix therefore does not derive the claim that declarative prompts are more likely to be answered; it assumes the conclusion in the form of Eq. (11). Moreover, lambda and mu are defined as joint probabilities of full sequences P(X,x1:n) and P(x1:n), not as per-token conditional probabilities, so the proportionality in Eq. (11) is not a consequence of the preceding definitions. The authors should either supply an independent argument for Eq. (11) or explicitly reframe the RIM claim as an empirical hypothesis whose only evidence is the ablation in Table 2.","section":"Appendix B, Eq. (11)"}],"minor_comments":[{"comment":"The phrase 'we additionally post-process the baseline model's output' is misleading: the truncation applies to REDA's target-model output, not to the baseline methods' outputs. Please reword to describe the actual protocol.","section":"Section 5.5"},{"comment":"The Glm-4 ASR for 'Ours' is 97.50% in Table 2 but 96.67% in Table 1 for the same condition; the SPARK-API AQC entry reads '11' instead of '1'. Please reconcile these values.","section":"Table 2"},{"comment":"The text says the average ASR for the keyword-detection step is 98%, but the mean of the seven listed values is approximately 97.86%; correct the number or explain the averaging procedure.","section":"Table 4"},{"comment":"The statement that no overlap occurred between the constructed dataset and the test datasets is not supported by any procedure; reporting an exact or near-duplicate matching check would strengthen the independence claim.","section":"Appendix C"},{"comment":"The claim that pre-training data contains more declarative than interrogative sentences is intuitive but unsupported by a corpus statistic; a citation or a small corpus count would make the premise concrete.","section":"Section 4.3 and Appendix B"},{"comment":"The 'origin' condition in the ablation differs from 'w/o RIM+EGE' in several ways beyond the absence of RIM and EGE, so the specific contribution of the Reverse Attack Perspective is not cleanly isolated; please clarify the exact prompt used in each condition.","section":"Section 6.3"}],"recommendation":"major_revision","confidential_remarks":"The main reason for major revision is the evaluation asymmetry in Section 5.5; it is openly described, so I do not see a hidden-agenda issue, but the resulting comparison is not like-for-like. If a symmetric re-evaluation lowers REDA's ASR or transfer rates, the paper should be reframed accordingly. The Appendix B derivation should be removed or replaced. The ablation's 'origin' condition is weak, and an additional baseline using the original interrogative prompt inside the REDA template would clarify the role of RIM."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing to know: the idea is genuinely neat. REDA frames the attack as a defensive task—the model is asked to produce countermeasures against harmful content, and the harmful steps ride along as 'explanations' and 'examples.' That's a legitimate twist on DRA and DeepInception, and the paper's own ablations show each component (reverse perspective, ICL examples, declarative rewriting) matters. The one-shot, cross-model transfer claim would be practically important if it holds.\n\nThe catch is the evaluation. Section 5.5 says that for REDA outputs, everything after '<COUNTERMEASURES>' is stripped out before the two-step judge runs, to 'prevent countermeasures from affecting the evaluation result.' But the template forces the model to end with that section—which is exactly where a safety disclaimer or refusal-like sentence would land. Baselines (GCG, AutoDAN, GPTFuzzer, DRA) are judged on their complete outputs, without any comparable truncation. So Tables 1, 4, 5, and the 96.2% transfer figure compare REDA's pre-countermeasure fragments against baselines' full responses. That's an apples-to-oranges comparison, and it plausibly inflates REDA's ASR. The authors are transparent about the choice, which is to their credit, but transparency doesn't make it symmetric. The fix is straightforward: run the judge on full outputs for all methods, or apply an analogous structural truncation to every method, and report both.\n\nThe other weak spot is Appendix B. The 'derivation' that declarative prompts are more likely to be answered is circular: Eq. (11) simply assumes the per-token probability ratio equals the corpus frequency ratio λ/μ, which already contains the conclusion that PInt < PDec if λ < μ. That's an intuition, not a proof. The ablation study backs the empirical effect, so the paper doesn't fall without it, but it shouldn't be presented as mathematics.\n\nAlso, no code or dataset release is mentioned. For a prompt-construction method, shipping the 260 QA pairs and the attack scripts is essential for reproducibility.\n\nWho is the paper for? People working on red-teaming, jailbreak evaluation, and model safety. The mechanism is worth studying; the current SOTA claims aren't yet established. I'd send it to peer review with a required revision on the evaluation protocol and a request to either justify or delete the RIM derivation. A good referee could turn this into a solid paper. I wouldn't cite it in its current form.","headline":"REDA is a clever reverse-framing jailbreak with a real one-shot/transfer story, but the headline numbers rest on an asymmetric truncation that strips REDA's own countermeasures section while scoring baselines on full outputs.","tokens_in":19214,"tokens_out":3908,"would_cite":false,"duration_ms":35170,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A prompt disguised as a defensive write-up can jailbreak a large language model on the first try.","keywords":["jailbreak attack","large language models","reverse attack perspective","in-context learning","prompt transferability","declarative prompts","attack success rate","model safety"],"falsifier":"Run the paper's two-step evaluation on the full, untruncated REDA responses and compare refusal rates with those of the baselines under the same scoring; if most full responses contain a refusal or safety disclaimer after the countermeasures marker, the one-step jailbreak claim as measured would not hold.","tokens_in":18261,"feed_emoji":"🔓","tokens_out":9282,"duration_ms":74771,"temperature":0.7,"pith_summary":"This paper claims that jailbreaking a large language model can be done in a single prompt, with no iterative optimization and no redesign for each target model. Its method, Reverse Embedded Defense Attack (REDA), asks the model to explain a harmful behavior, give concrete examples, and then propose countermeasures, so the model treats the task as safety work while actually producing the harmful content. REDA adds a few in-context examples and rewrites the request as a declarative sentence to lower suspicion. On seven open- and closed-source chat models, the paper reports the highest attack success rates with a query count of one, and reports that prompts generated on one model transfer to the others with 96.20% average success. If the results hold, single-prompt attacks become a cheap and practical way to probe and improve model safety.","feed_headline":"One-step jailbreak hides harmful requests inside 'defense' prompts","feed_subtitle":"A reverse attack embeds harmful content in countermeasure templates, succeeding on the first query across seven models.","key_machinery":"The load-bearing mechanism is the reverse prompt template, which the paper calls the Reverse Attack Perspective (RAP). The template uses role and task tokens such as \"##Role##\" and \"##Task##\" and asks for three sections—explanation, concrete examples, countermeasures—so harmful content is embedded in the middle of a defensive answer rather than requested directly. Example-Guided Enhancement (EGE) selects the four most similar question-answer pairs from the paper's 260-pair, 13-category dataset using Jaccard similarity and places them in the prompt as in-context examples that reinforce the defensive frame. Request Intent Mitigation (RIM) rewrites the request from interrogative to declarative form; the paper's derivation approximates the resulting probability gain by the ratio $(\\lambda/\\mu)^L$, where $\\lambda$ and $\\mu$ are the frequencies of interrogative and declarative sentences in pretraining data. The paper's success measure is a two-step judge: a response must avoid rejection keywords and then pass a fine-tuned referee classifier, and REDA outputs are truncated before the countermeasures section before being judged.","core_discovery":"On the paper's own terms, the discovery is that safety alignment can be redirected by starting from the output side. Rather than asking \"how to rob a bank,\" REDA instructs the model to produce a structured defensive write-up with special tokens such as <DANGEROUS_KNOWLEDGE_PROCEDURAL_STEPS>, <EXAMPLE_OF_DANGEROUS_KNOWLEDGE>, and <COUNTERMEASURES>. The harmful procedure appears as the example that the defense is meant to counter, so the model perceives itself as performing a legitimate defensive task and cooperates on the first query. The paper reports state-of-the-art attack success rates on all seven models tested, including the most refusal-prone ones, with an average query count of one, and reports that its generated prompts transfer to other models at an average success rate of 96.20%. It also claims declarative prompts outperform interrogative prompts, supporting this with a corpus-frequency argument: if pretraining data contains $\\lambda$ interrogative and $\\mu$ declarative sentences, the ratio of response probabilities for a length-$L$ continuation is approximately $(\\lambda/\\mu)^L$, so declarative phrasing is more likely to produce text.","pith_inferences":["A natural extension is to test whether the reverse template also bypasses safety filters in retrieval-augmented or tool-using systems, where final answers are assembled from multiple sources and a defensive preamble may not be inspected.","Because the paper truncates REDA outputs at the countermeasures marker, a defender could neutralize the attack by scoring full responses; if that section usually contains a refusal or disclaimer, the reported advantage may overstate clean jailbreaks.","The corpus-frequency argument predicts that attack success should vary with pretraining language mix, so the method's transferability in non-English or safety-tuned corpora is a testable consequence the paper leaves open.","REDA could serve as a universal probe: generate one prompt per harmful category and reuse it across models to compare alignment without per-model tuning."],"forward_implications":["If REDA works as reported, attack cost falls to one query and roughly three seconds per successful jailbreak on the tested models, making large-scale red-teaming feasible.","Attack prompts no longer need to be regenerated per model; prompts produced on one model transfer to the other tested models at 96.20% average success.","Defenses that look for rejection phrases or token-level anomalies are insufficient, because REDA prompts are readable, semantically coherent, and framed as defensive tasks.","Both the declarative rewrite and the in-context defensive examples carry part of the attack: ablations show removing either one lowers success, with the largest drop on the most refusal-prone model.","Closed API models can be probed without gradient access or repeated querying, since one generated prompt family works across targets."],"supporting_citations":[{"why":"Supplies the GCG gradient-based jailbreak baseline and about 60% of the attack-example dataset used for in-context enhancement.","marker":"Zou et al., 2023"},{"why":"Supplies the DRA black-box baseline and the 120-question harmful-behavior test set that REDA is evaluated on.","marker":"Liu et al., 2024"},{"why":"Supplies the GPTFuzzer black-box fuzzing baseline that REDA compares against in attack efficiency and transfer.","marker":"Yu et al., 2023"},{"why":"Supplies the AutoDAN white-box baseline against which REDA's one-step success is contrasted.","marker":"Zhu et al., 2024"},{"why":"Supplies the fine-tuned referee classifier used as the second stage of the paper's two-step jailbreak evaluation.","marker":"Mazeika et al. (2024)"},{"why":"Establishes in-context learning, the mechanism REDA uses to reinforce the model's defensive-task interpretation.","marker":"Brown (2020)"},{"why":"Defines the similarity measure used to select the top-four examples for Example-Guided Enhancement.","marker":"Jaccard, 1901"}],"fun_headline_variants":["One-step jailbreak disguised as 'defense' prompts","Reverse attack embeds harm in defensive templates","One query jailbreak via fake defense","Cross-model jailbreak in a single step","Hide harmful content in defense to jailbreak"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The result rests on the assumption that scoring REDA responses after cutting off everything after the 'countermeasures' section is a fair, apples-to-apples comparison; if that section usually contains disclaimers or refusals, the reported success rates could be inflated.","fun_headline_variants_meta":{"raw":{"variants":["One-step jailbreak disguised as 'defense' prompts","Reverse attack embeds harm in defensive templates","One query jailbreak via fake defense","Cross-model jailbreak in a single step","Hide harmful content in defense to jailbreak"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00081,"raw_usage":{"total_tokens":3597,"prompt_tokens":1032,"completion_tokens":2565,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":648,"completion_tokens_details":{"reasoning_tokens":2497}},"tokens_in":648,"tokens_out":2565,"duration_ms":16024,"temperature":1.0,"reasoning_tokens":2497,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:53:39.510456+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the paper's two-step evaluation on the full, untruncated REDA responses and compare refusal rates with those of the baselines under the same scoring; if most full responses contain a refusal or safety disclaimer after the countermeasures marker, the one-step jailbreak claim as measured would not hold.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the similarity measure used to select the top-four examples for Example-Guided Enhancement."}],"review_version":1}