{"id":"8ee3c511-34cf-4696-82c2-c6263e1ad09b","arxiv_id":"2505.10838","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"LARGO optimizes a latent embedding to make a model answer affirmatively, decodes it into a natural-language suffix with the model itself, and iteratively refines until the suffix jailbreaks the model.","lead":"The paper introduces LARGO, a jailbreak method that searches for adversarial prompts in the continuous hidden space of an LLM and then asks the same LLM to translate that search result into fluent text. It reports higher attack success rates than GCG and AutoDAN on Llama-2 and Phi-3 models over AdvBench and JailbreakBench.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 44-point margin over AutoDAN is suspect: Table 1 reports AutoDAN at 18% on Llama-2-7B whereas its published ASR is far higher, and no code/seeds/variance are given to rule out a misconfigured baseline.","rationale":"I considered the reader's weakest assumption that self-reflective decoding preserves the adversarial objective of the optimized latent. That concern is real, but the random-latent ablation in Section 4.1 partially addresses it, and the iterative refinement loop in Algorithm 1 means a single decode need not preserve the entire objective for the pipeline to succeed. The more immediately falsifiable load-bearing link in the central claim is the empirical comparison: Table 1's AutoDAN numbers are implausibly low relative to AutoDAN's published results, and no code, seeds, or variance are supplied. If the AutoDAN baseline is misconfigured, the headline 'surpasses ... by 44 points' fails even if the latent-decoding mechanism works as described. I retain the reader's CONDITIONAL verdict because the concern is verification-oriented; the concrete AutoDAN rerun is the required condition for accepting the superiority claim.","tokens_in":11863,"tokens_out":10784,"duration_ms":115488,"concrete_test":"Run the official AutoDAN implementation with its published default hyperparameters and success criteria on the same 200-prompt AdvBench sample and the same Llama-2-7B-chat model used in Table 1, evaluating with the paper's keyword/refusal ASR. If AutoDAN's ASR reaches published levels (e.g., >=60%) or exceeds LARGO's 42.0%, the claimed 44-point margin and the abstract's superiority claim are not supported. Repeating LARGO over three random seeds with released code to report mean and standard deviation would further determine whether any remaining gap is statistically significant.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract's central quantitative claim is a 44-point ASR improvement over AutoDAN. Table 1 reports AutoDAN at 18.0% (Llama-2-7B) and 7.0% (Llama-2-13B) on AdvBench, values far below AutoDAN's own published results on the same models, which typically exceed 60% on Llama-2-7B under its default configuration. The authors state in Section 3.1 that each baseline was run with 'identical suffix length and search iterations,' but AutoDAN's hierarchical genetic algorithm is not designed for a fixed 200-token suffix; forcing this setting can artificially depress its ASR. Because no code, random seeds, or error bars are provided, the reported margin cannot be separated from baseline misconfiguration or evaluation noise. If AutoDAN's true ASR under default settings is near published levels, LARGO's 42.0% in Table 1 is not a 44-point superiority and could even be inferior. This alone is enough to call the headline claim unverified, independent of the latent-decoding mechanism.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces LARGO, a jailbreak attack that optimizes a continuous latent suffix embedding via cross-entropy toward an affirmative target response, decodes that embedding into natural language by asking the LLM to complete a 'summarize the message' template, and iteratively projects the decoded suffix back into embedding space until the target model responds affirmatively. The method is evaluated in single-prompt, universal, and transfer settings on 200-prompt subsets of AdvBench and JailbreakBench across Llama-2-7B, Llama-2-13B, and Phi-3-4B, with keyword-based ASR and GPT-2 perplexity as metrics. The paper claims LARGO surpasses GCG, AutoDAN, and AdvPrompter, with a headline 44-point improvement over AutoDAN.","tokens_in":12092,"tokens_out":5857,"duration_ms":58935,"significance":"If the results are reproducible and the baseline comparison is fair, LARGO would be a meaningful contribution: it is an automatic gradient-based attack that produces fluent suffixes, is faster than agentic LLM-based attacks, and shows transfer across model families. The random-latent ablation in Table 5 is a well-designed control, and the StrongREJECT consistency check in Table 2 adds credibility to the keyword-based ASR metric. The central reservation is that the paper's headline quantitative claims currently rest on a single-run, no-code evaluation whose AutoDAN baseline numbers are implausibly low relative to AutoDAN's published results, so the claimed margin is not yet established.","major_comments":[{"comment":"The headline claim of a 44-point improvement over AutoDAN is not supported by the reported baseline configuration. Table 1 reports AutoDAN ASR of 18.0% on Llama-2-7B and 7.0% on Llama-2-13B for AdvBench, but AutoDAN's published results on the same models are substantially higher under its standard settings. The statement in §3.1 that baselines were run with 'identical suffix length and search iterations' is not a sufficient fairness argument, because AutoDAN's hierarchical genetic algorithm is designed around its own prompt structure and is not intended to be forced into a fixed 200-token suffix. Since no code, seeds, or error bars are given, the reported margin cannot be separated from baseline misconfiguration or evaluation noise. The abstract's central quantitative claim must be re-established with a properly configured AutoDAN and with variance estimates.","section":"§3.1, Table 1"},{"comment":"All experimental tables report single runs without error bars, confidence intervals, or seeds. The attack and baselines involve stochastic optimization and random subsampling of 200 prompts from each benchmark, so the observed differences—especially the small transfer gaps in Table 3—may be within sampling variability. For example, with 200 test prompts, a 42% ASR carries a standard error of about 3.5%, and differences of 5–10 points in transfer settings are not interpretable without repeated runs. The authors should report multiple seeds with means and standard deviations, or at minimum provide exact seeds and code so the results can be reproduced.","section":"Tables 1, 3, 4"},{"comment":"The self-reflective decoding step is the load-bearing bridge between the continuous latent optimization and the deployed discrete suffix, but the paper does not verify that decoding preserves the optimized latent's adversarial behavior. The random-latent ablation in Table 5 shows that optimized latent interpretations outperform random latent interpretations, but it does not isolate the contribution of the latent optimization from the decoding template or from the iterative re-projection Emb(s(t)). For instance, the decoding template ends with 'Assistant: Sure, I will summarize the message:', which may bias the generated suffix toward affirmative continuations, and the iterative refinement could be responsible for much of the gain. An additional control that decodes the same template with a non-optimized context vector, or that starts the refinement from a random fluent suffix without latent optimization, would clarify the mechanism.","section":"§2.1.2, §2.1.3"},{"comment":"The universal attack procedure in Algorithm 2 depends on a success threshold for early stopping, but the threshold value and the number of epochs actually used are not reported in §3.7. Because Table 4 reports ASR on 200 test prompts after early stopping, different threshold choices could materially change the comparison with GCG. The authors should report the threshold, the stopping epoch, and the training/test prompt split so that the universal attack results are reproducible.","section":"§2.2, §3.7"}],"minor_comments":[{"comment":"There are several grammatical errors: 'the discrete language space make' should be 'the discrete language space makes'; 'recursively call' should be 'recursively calls'; 'the internal's of the LLM' should be 'the internals of the LLM'; and 'we underscoring the need' should be 'we underscore the need'.","section":"Abstract and Introduction"},{"comment":"The phrase 'mixed-precision training' is inaccurate because the paper optimizes a suffix embedding rather than training a model; this should be reworded to 'mixed-precision optimization' or 'mixed-precision evaluation'.","section":"§3.1"},{"comment":"The random-latent ablation says latent vectors are 'randomly initialized' but does not specify the distribution. State whether they are sampled from a standard normal, uniform, or another distribution so the control is reproducible.","section":"§4.1"},{"comment":"The keyword-based ASR metric relies on 'manually extract keywords from each attack prompt,' but the paper does not specify how many keywords were extracted per prompt, whether extraction was done before running attacks, or whether there was any consistency check. Adding these details would make the metric less subjective.","section":"§3.4"},{"comment":"The caption says 'As shown by the loss graph,' but the figure as printed does not contain a loss graph; either add the plot or adjust the caption to describe the trajectory shown.","section":"Figure 2"},{"comment":"There is a typo, 'transfering' should be 'transferring', and 'optimized on one mode' should be 'optimized on one model'.","section":"§3.6"},{"comment":"In the pseudocode, the loop 'for batch{qi, y*i} do z(t)←OptimizeL(z(t)) over [qi; z(t)]' is ambiguous: it appears to optimize sequentially over each example in the batch rather than over the aggregate batch objective defined in §2.2. Clarify whether the optimization is performed on the summed loss or on each example separately.","section":"Algorithm 2"}],"recommendation":"major_revision","confidential_remarks":"The paper's central claim is currently unverifiable because the key comparison against AutoDAN rests on a configuration that appears to depress the baseline, and no code or seeds are provided. If the authors can rerun the baselines under their standard configurations, add variance estimates, and release code, the work may become publishable. I would also ask the editor to consider whether the novelty relative to the authors' own SelfIE line is sufficiently articulated; the current framing does not clearly position what is new beyond applying self-interpretation to jailbreak suffix generation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The idea is interesting and the random-latent ablation is a genuinely useful control. But the central quantitative claim — beating AutoDAN by 44 points — is not supported by the evidence as reported. Table 1 lists AutoDAN at 18% on Llama-2-7B AdvBench; AutoDAN's own published numbers are far higher under default settings. The authors say baselines were run with identical suffix length and search iterations, but AutoDAN's genetic algorithm is not designed for a fixed 200-token suffix, and forcing that can depress it. Without code, seeds, or error bars, the headline margin is unverified. If AutoDAN were run in its intended configuration, LARGO's 42% might be a modest gain or a loss.\n\nWhat is actually new: the three-stage pipeline (latent embedding optimization, self-reflective decoding into natural language, back-projection refinement) is not in the baselines. The random-latent ablation in Table 5 shows the optimization step matters: random latent interpretations are fluent but nearly useless. That is real evidence for the mechanism. The StrongREJECT check on one configuration is a good-faith effort, and the transfer experiments, while noisy, show the suffixes are not model-specific gibberish.\n\nSoft spots. The load-bearing assumption is that decoding the optimized latent into discrete text via the self-reflective template preserves the adversarial objective. The paper offers no verification of that other than the empirical ASR, which is fine but is exactly the thing we cannot fully check yet. The ablation is single-run, no variance. AdvPrompter is at 2% ASR, suspiciously low. The '44 points' headline is cherry-picked from the Llama-2-13B AdvBench cell; average gains are smaller. The authors' own SelfIE mechanism is cited in Related Work, so the lineage is not hidden, but the connection could be stated more directly.\n\nWho this is for: red teams and safety-evaluation people who want an automated fluent suffix generator. If the results hold after code release, it is a useful subfield contribution. It deserves a serious referee, with the condition that code, seeds, and baseline configs are submitted.","headline":"LARGO is a plausible latent-space jailbreak method with a good random-latent control, but the 44-point margin over AutoDAN is not credible until code and baseline configs are released.","tokens_in":12615,"tokens_out":2073,"would_cite":false,"duration_ms":20724,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Latent-space gradient optimization, decoded back into words by the same model, yields fluent jailbreak suffixes that outperform GCG and AutoDAN on standard benchmarks.","keywords":["jailbreak","latent space optimization","self-reflective decoding","adversarial suffix","large language model safety","red teaming","transfer attack","perplexity-based defense"],"falsifier":"Run the full LARGO pipeline but replace the self-reflective decoding step with a non-instruction-tuned base model that cannot follow the 'summarize the message' template; if the resulting suffixes jailbreak at the same rate, the interpretive step is not essential. Conversely, if attack success collapses, that confirms the self-reflective decoding is the component carrying the optimized adversarial objective into text.","tokens_in":11648,"feed_emoji":"🧠","tokens_out":6678,"duration_ms":54778,"temperature":0.7,"pith_summary":"LARGO attacks aligned LLMs by optimizing a continuous adversarial suffix in the model's token-embedding space rather than in discrete text. The optimized vector is then fed back to the same model through a chat template that asks it to summarize the latent suffix, and the model's own generated words become the deployed attack suffix. Because the suffix comes from the model itself, it is fluent and low-perplexity rather than token soup, while retaining the jailbreaking behavior found by gradient descent. The paper reports that this single method outperforms GCG, AutoDAN, and AdvPrompter on AdvBench and JailbreakBench across Llama-2-7B, Llama-2-13B, and Phi-3-4B, with gains over AutoDAN reaching as high as 44 percentage points. The significance is that gradient-based optimization, previously limited to unreadable token-level attacks, can be redirected into the latent space and still produce natural-language prompts.","feed_headline":"Latent-space jailbreak beats GCG and AutoDAN by 44 points","feed_subtitle":"Optimizing inside the model's embedding space and decoding to words yields fluent suffixes that bypass perplexity filters.","key_machinery":"The load-bearing mechanism is the combination of latent-embedding optimization with self-reflective decoding. The paper optimizes a continuous suffix vector $z$ directly in the embedding space by minimizing $\\mathcal{L}(z)=\\mathrm{CrossEntropy}(\\mathrm{Model}([q;z]), y^\\star)$, then uses the same instruction-tuned LLM to interpret $z$ into natural language via the template 'User: <latent suffix> Assistant: Sure, I will summarize the message:', producing a discrete suffix $s$. The final piece is back-projection: if $s$ fails, it is converted back into a new latent vector $z^{(t+1)}=\\mathrm{Emb}(s^{(t)})$ and the optimization restarts, so the loop alternates between continuous optimization and discrete verbalization. For the universal setting, the loss is averaged over a batch of harmful queries sharing the same latent suffix. This machinery is what lets gradient-based search produce fluent, human-readable suffixes instead of token-level gibberish.","core_discovery":"The central claim is that a jailbreak suffix can be found by gradient descent over a continuous latent embedding, then verbalized by the same LLM without losing its adversarial effect. Starting from a harmful user query, LARGO appends a trainable latent vector $z$ of length $L$, optimizes it with Adam against the cross-entropy loss of producing an affirmative target such as 'Sure, here is...', and then prompts the model to complete 'User: <latent suffix> Assistant: Sure, I will summarize the message:' so that the generated tokens form the discrete suffix $s$. If the suffix does not jailbreak the model, it is projected back into embedding space via the embedding matrix and the loop repeats. The paper's evidence is that on AdvBench and JailbreakBench the method reaches 42-86% keyword-based ASR across target models, exceeds GCG on average by 22.0 points and AutoDAN by 27.3 points, keeps suffix perplexity second lowest among baselines, transfers across model families, and beats GCG's universal attack with far lower perplexity. The ablation with random latents (2.0-5.5% ASR versus 42-79% for optimized latents) is used to argue that the optimized latent, not the fluent decoding template, carries the jailbreak.","pith_inferences":["If self-reflective decoding reliably preserves an optimized latent's intent, the same three-stage loop could be repurposed for benign goals such as steering model behavior, eliciting faithful summaries of hidden states, or transferring other continuous objectives into natural-language instructions; the paper does not claim this.","The scaling with suffix length suggests the latent vector acts as a capacity-limited carrier of the adversarial objective; a testable extension is whether latent vectors longer than 300 tokens push ASR above 65% and whether the same scaling holds on stronger models.","The keyword-based ASR metric may inflate LARGO's margin, since any response mentioning the prompt's keywords counts as success even if the content is not genuinely harmful; the StrongREJECT results in Table 2 preserve the ordering but compress the differences.","Because LARGO uses the target model's own embedding matrix and chat template, its transferability may depend on architectural similarity: Llama-13B to Llama-7B transfers best at 31.37%, while cross-family transfers might improve if the latent were optimized in a more model-agnostic semantic space."],"forward_implications":["On the tested models and benchmarks, LARGO's single-prompt attack beats GCG by an average of 22.0 percentage points, AutoDAN by 27.3 points, and AdvPrompter by 57.8 points in keyword-based attack success rate.","The universal LARGO suffix generalizes across a held-out set of 200 harmful prompts, reaching 20-22% ASR on Llama-2 models compared with 5.5-9.5% for universal GCG, while dropping suffix perplexity from around 1,100 to below 20 on Llama-2-7B.","Suffixes optimized on one model transfer to other models in eight of nine settings tested, including cross-family transfer from Phi-3-4B to Qwen-2.5-14B at 13.29% ASR.","Because LARGO suffixes are fluent and low-perplexity, guardrails that filter on perplexity will not reliably catch them, and defenses need to target semantic or latent-level cues instead.","Longer suffixes scale attack effectiveness, from 13.0% ASR at length 50 to 65.0% at length 300 on Llama-2-7B, so increasing suffix capacity is a direct route to stronger attacks."],"supporting_citations":[{"why":"Defines the GCG baseline and the AdvBench dataset; LARGO is compared against both, and the affirmative-target cross-entropy objective is adapted from this line of work.","marker":"Zou et al. (2023)"},{"why":"Provides the AutoDAN baseline that produces fluent jailbreaks via hierarchical genetic algorithm; a key comparison for attack success rate and perplexity.","marker":"Liu et al. (2024)"},{"why":"Provides the AdvPrompter baseline that trains an attacker LLM to generate human-readable suffixes; a key comparison and the target of the 44-point claim.","marker":"Paulus et al. (2024)"},{"why":"Supplies the StrongREJECT LLM-based evaluation metric used to verify that LARGO's jailbroken responses are specific and convincing, not merely affirmative.","marker":"Souly et al. (2024)"},{"why":"Demonstrates that LLMs can verbalize their own embeddings (SelfIE), providing the conceptual basis for the self-reflective decoding stage.","marker":"Chen et al. (2024)"},{"why":"Shows activations can be decoded into natural language (LatentQA), supporting the interpretation stage of LARGO.","marker":"Pan et al. (2024)"},{"why":"Provides the JailbreakBench dataset used for evaluating attack success rate.","marker":"Chao et al. (2024)"},{"why":"Describes perplexity-based detection of language-model attacks, the defense that LARGO's low-perplexity suffixes are designed to evade.","marker":"Alon and Kamfonas (2023)"},{"why":"Provides the Llama-2 chat models used as the primary target models in the experiments.","marker":"Touvron et al. (2023)"}],"fun_headline_variants":["Latent-space gradients yield fluent jailbreaks, beating AutoDAN by 44","Gradient descent in LLM latent space defeats AutoDAN by 44 points","LARGO: optimize latent, decode jailbreak, outperform AutoDAN by 44","Fluent jailbreaks via latent gradient optimization, +44 ASR over AutoDAN","Latent reflection attack: gradient-optimized prompts top AutoDAN by 44"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the self-reflective decoding step, which turns the optimized continuous latent vector into discrete natural-language text, preserves the adversarial behavior that gradient optimization found; if the verbalized suffix does not carry that intent, LARGO collapses to random fluent text.","fun_headline_variants_meta":{"raw":{"variants":["Latent-space gradients yield fluent jailbreaks, beating AutoDAN by 44","Gradient descent in LLM latent space defeats AutoDAN by 44 points","LARGO: optimize latent, decode jailbreak, outperform AutoDAN by 44","Fluent jailbreaks via latent gradient optimization, +44 ASR over AutoDAN","Latent reflection attack: gradient-optimized prompts top AutoDAN by 44"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001059,"raw_usage":{"total_tokens":4469,"prompt_tokens":994,"completion_tokens":3475,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":610,"completion_tokens_details":{"reasoning_tokens":3365}},"tokens_in":610,"tokens_out":3475,"duration_ms":23888,"temperature":1.0,"reasoning_tokens":3365,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:02:49.289546+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the full LARGO pipeline but replace the self-reflective decoding step with a non-instruction-tuned base model that cannot follow the 'summarize the message' template; if the resulting suffixes jailbreak at the same rate, the interpretive step is not essential. Conversely, if attack success collapses, that confirms the self-reflective decoding is the component carrying the optimized adversarial objective into text.","supporting_citations":[{"cited_title":"do anything now","cited_arxiv_id":null,"evidence_quote":"Demonstrates that LLMs can verbalize their own embeddings (SelfIE), providing the conceptual basis for the self-reflective decoding stage."}],"review_version":1}