Pith. sign in

REVIEW 4 major objections 7 minor 1 cited by

LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs

T0 review · 4 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Latent-space gradient optimization, decoded back into words by the same model, yields fluent jailbreak suffixes that outperform GCG and AutoDAN on standard benchmarks.

desk verdict LARGO is a plausible latent-space jailbreak method with a good random-latent control, but the 44-point margin over AutoDAN is not credible until code and baseline configs are released. read the letter →

arxiv 2505.10838 v1 pith:X4NSOE73 submitted 2025-05-16 cs.LG cs.CLcs.CR

Ran Li , Hao Wang , Chengzhi Mao This is my paper · ORCID
classification cs.LGcs.CLcs.CR
keywords jailbreaklatentspaceoptimizationself-reflectivedecodingadversarialsuffixlargelanguagemodelsafetyredteamingtransferattackperplexity-baseddefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LARGO attacks aligned LLMs by optimizing a continuous adversarial suffix in the model's token-embedding space rather than in discrete text. The optimized vector is then fed back to the same model through a chat template that asks it to summarize the latent suffix, and the model's own generated words become the deployed attack suffix. Because the suffix comes from the model itself, it is fluent and low-perplexity rather than token soup, while retaining the jailbreaking behavior found by gradient descent. The paper reports that this single method outperforms GCG, AutoDAN, and AdvPrompter on AdvBench and JailbreakBench across Llama-2-7B, Llama-2-13B, and Phi-3-4B, with gains over AutoDAN reaching as high as 44 percentage points. The significance is that gradient-based optimization, previously limited to unreadable token-level attacks, can be redirected into the latent space and still produce natural-language prompts.

What carries the argument

The load-bearing mechanism is the combination of latent-embedding optimization with self-reflective decoding. The paper optimizes a continuous suffix vector $z$ directly in the embedding space by minimizing $\mathcal{L}(z)=\mathrm{CrossEntropy}(\mathrm{Model}([q;z]), y^\star)$, then uses the same instruction-tuned LLM to interpret $z$ into natural language via the template 'User: <latent suffix> Assistant: Sure, I will summarize the message:', producing a discrete suffix $s$. The final piece is back-projection: if $s$ fails, it is converted back into a new latent vector $z^{(t+1)}=\mathrm{Emb}(s^{(t)})$ and the optimization restarts, so the loop alternates between continuous optimization and discrete verbalization. For the universal setting, the loss is averaged over a batch of harmful queries sharing the same latent suffix. This machinery is what lets gradient-based search produce fluent, human-readable suffixes instead of token-level gibberish.

What would settle it

Run the full LARGO pipeline but replace the self-reflective decoding step with a non-instruction-tuned base model that cannot follow the 'summarize the message' template; if the resulting suffixes jailbreak at the same rate, the interpretive step is not essential. Conversely, if attack success collapses, that confirms the self-reflective decoding is the component carrying the optimized adversarial objective into text.

Watch

Extended reading notes

Core claim

The central claim is that a jailbreak suffix can be found by gradient descent over a continuous latent embedding, then verbalized by the same LLM without losing its adversarial effect. Starting from a harmful user query, LARGO appends a trainable latent vector $z$ of length $L$, optimizes it with Adam against the cross-entropy loss of producing an affirmative target such as 'Sure, here is...', and then prompts the model to complete 'User: <latent suffix> Assistant: Sure, I will summarize the message:' so that the generated tokens form the discrete suffix $s$. If the suffix does not jailbreak the model, it is projected back into embedding space via the embedding matrix and the loop repeats. The paper's evidence is that on AdvBench and JailbreakBench the method reaches 42-86% keyword-based ASR across target models, exceeds GCG on average by 22.0 points and AutoDAN by 27.3 points, keeps suffix perplexity second lowest among baselines, transfers across model families, and beats GCG's universal attack with far lower perplexity. The ablation with random latents (2.0-5.5% ASR versus 42-79% for optimized latents) is used to argue that the optimized latent, not the fluent decoding template, carries the jailbreak.

Load-bearing premise

The load-bearing premise is that the self-reflective decoding step, which turns the optimized continuous latent vector into discrete natural-language text, preserves the adversarial behavior that gradient optimization found; if the verbalized suffix does not carry that intent, LARGO collapses to random fluent text.

Editorial extensions

If this is right

  • On the tested models and benchmarks, LARGO's single-prompt attack beats GCG by an average of 22.0 percentage points, AutoDAN by 27.3 points, and AdvPrompter by 57.8 points in keyword-based attack success rate.
  • The universal LARGO suffix generalizes across a held-out set of 200 harmful prompts, reaching 20-22% ASR on Llama-2 models compared with 5.5-9.5% for universal GCG, while dropping suffix perplexity from around 1,100 to below 20 on Llama-2-7B.
  • Suffixes optimized on one model transfer to other models in eight of nine settings tested, including cross-family transfer from Phi-3-4B to Qwen-2.5-14B at 13.29% ASR.
  • Because LARGO suffixes are fluent and low-perplexity, guardrails that filter on perplexity will not reliably catch them, and defenses need to target semantic or latent-level cues instead.
  • Longer suffixes scale attack effectiveness, from 13.0% ASR at length 50 to 65.0% at length 300 on Llama-2-7B, so increasing suffix capacity is a direct route to stronger attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If self-reflective decoding reliably preserves an optimized latent's intent, the same three-stage loop could be repurposed for benign goals such as steering model behavior, eliciting faithful summaries of hidden states, or transferring other continuous objectives into natural-language instructions; the paper does not claim this.
  • The scaling with suffix length suggests the latent vector acts as a capacity-limited carrier of the adversarial objective; a testable extension is whether latent vectors longer than 300 tokens push ASR above 65% and whether the same scaling holds on stronger models.
  • The keyword-based ASR metric may inflate LARGO's margin, since any response mentioning the prompt's keywords counts as success even if the content is not genuinely harmful; the StrongREJECT results in Table 2 preserve the ordering but compress the differences.
  • Because LARGO uses the target model's own embedding matrix and chat template, its transferability may depend on architectural similarity: Llama-13B to Llama-7B transfers best at 31.37%, while cross-family transfers might improve if the latent were optimized in a more model-agnostic semantic space.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper introduces LARGO, a jailbreak attack that optimizes a continuous latent suffix embedding via cross-entropy toward an affirmative target response, decodes that embedding into natural language by asking the LLM to complete a 'summarize the message' template, and iteratively projects the decoded suffix back into embedding space until the target model responds affirmatively. The method is evaluated in single-prompt, universal, and transfer settings on 200-prompt subsets of AdvBench and JailbreakBench across Llama-2-7B, Llama-2-13B, and Phi-3-4B, with keyword-based ASR and GPT-2 perplexity as metrics. The paper claims LARGO surpasses GCG, AutoDAN, and AdvPrompter, with a headline 44-point improvement over AutoDAN.

Significance. If the results are reproducible and the baseline comparison is fair, LARGO would be a meaningful contribution: it is an automatic gradient-based attack that produces fluent suffixes, is faster than agentic LLM-based attacks, and shows transfer across model families. The random-latent ablation in Table 5 is a well-designed control, and the StrongREJECT consistency check in Table 2 adds credibility to the keyword-based ASR metric. The central reservation is that the paper's headline quantitative claims currently rest on a single-run, no-code evaluation whose AutoDAN baseline numbers are implausibly low relative to AutoDAN's published results, so the claimed margin is not yet established.

major comments (4)
  1. [§3.1, Table 1] The headline claim of a 44-point improvement over AutoDAN is not supported by the reported baseline configuration. Table 1 reports AutoDAN ASR of 18.0% on Llama-2-7B and 7.0% on Llama-2-13B for AdvBench, but AutoDAN's published results on the same models are substantially higher under its standard settings. The statement in §3.1 that baselines were run with 'identical suffix length and search iterations' is not a sufficient fairness argument, because AutoDAN's hierarchical genetic algorithm is designed around its own prompt structure and is not intended to be forced into a fixed 200-token suffix. Since no code, seeds, or error bars are given, the reported margin cannot be separated from baseline misconfiguration or evaluation noise. The abstract's central quantitative claim must be re-established with a properly configured AutoDAN and with variance estimates.
  2. [Tables 1, 3, 4] All experimental tables report single runs without error bars, confidence intervals, or seeds. The attack and baselines involve stochastic optimization and random subsampling of 200 prompts from each benchmark, so the observed differences—especially the small transfer gaps in Table 3—may be within sampling variability. For example, with 200 test prompts, a 42% ASR carries a standard error of about 3.5%, and differences of 5–10 points in transfer settings are not interpretable without repeated runs. The authors should report multiple seeds with means and standard deviations, or at minimum provide exact seeds and code so the results can be reproduced.
  3. [§2.1.2, §2.1.3] The self-reflective decoding step is the load-bearing bridge between the continuous latent optimization and the deployed discrete suffix, but the paper does not verify that decoding preserves the optimized latent's adversarial behavior. The random-latent ablation in Table 5 shows that optimized latent interpretations outperform random latent interpretations, but it does not isolate the contribution of the latent optimization from the decoding template or from the iterative re-projection Emb(s(t)). For instance, the decoding template ends with 'Assistant: Sure, I will summarize the message:', which may bias the generated suffix toward affirmative continuations, and the iterative refinement could be responsible for much of the gain. An additional control that decodes the same template with a non-optimized context vector, or that starts the refinement from a random fluent suffix without latent optimization, would clarify the mechanism.
  4. [§2.2, §3.7] The universal attack procedure in Algorithm 2 depends on a success threshold for early stopping, but the threshold value and the number of epochs actually used are not reported in §3.7. Because Table 4 reports ASR on 200 test prompts after early stopping, different threshold choices could materially change the comparison with GCG. The authors should report the threshold, the stopping epoch, and the training/test prompt split so that the universal attack results are reproducible.
minor comments (7)
  1. [Abstract and Introduction] There are several grammatical errors: 'the discrete language space make' should be 'the discrete language space makes'; 'recursively call' should be 'recursively calls'; 'the internal's of the LLM' should be 'the internals of the LLM'; and 'we underscoring the need' should be 'we underscore the need'.
  2. [§3.1] The phrase 'mixed-precision training' is inaccurate because the paper optimizes a suffix embedding rather than training a model; this should be reworded to 'mixed-precision optimization' or 'mixed-precision evaluation'.
  3. [§4.1] The random-latent ablation says latent vectors are 'randomly initialized' but does not specify the distribution. State whether they are sampled from a standard normal, uniform, or another distribution so the control is reproducible.
  4. [§3.4] The keyword-based ASR metric relies on 'manually extract keywords from each attack prompt,' but the paper does not specify how many keywords were extracted per prompt, whether extraction was done before running attacks, or whether there was any consistency check. Adding these details would make the metric less subjective.
  5. [Figure 2] The caption says 'As shown by the loss graph,' but the figure as printed does not contain a loss graph; either add the plot or adjust the caption to describe the trajectory shown.
  6. [§3.6] There is a typo, 'transfering' should be 'transferring', and 'optimized on one mode' should be 'optimized on one model'.
  7. [Algorithm 2] In the pseudocode, the loop 'for batch{qi, y*i} do z(t)←OptimizeL(z(t)) over [qi; z(t)]' is ambiguous: it appears to optimize sequentially over each example in the batch rather than over the aggregate batch objective defined in §2.2. Clarify whether the optimization is performed on the summed loss or on each example separately.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: LARGO's central claim is an empirical attack result evaluated against external baselines and benchmarks, with a random-latent control; self-citations are related work and not load-bearing.

full rationale

The paper's central claim—that latent-space optimization plus self-reflective decoding yields fluent suffixes with high attack success rate—is an empirical result, not a formal derivation, and it is tested against external benchmarks (AdvBench, JailbreakBench) and external baselines (GCG, AutoDAN, AdvPrompter). The optimization loss (cross-entropy toward an affirmative target y*) and the keyword-based success criterion are aligned by design, but this is the attack objective rather than a circular prediction: the crucial stage is the discrete decoding of the optimized latent, and the paper does not assume this decoding preserves the loss; instead it measures the resulting ASR, including a random-latent ablation (Table 5) that controls for fluent-text confounds. The universal-attack evaluation is held out on 200 test prompts disjoint from the 10 training prompts, so that result is a genuine transfer measurement. The self-citations (SelfIE, Diversity Attack) appear only in Related Work and are not used to justify the method's correctness; no uniqueness theorem or prior result is invoked to rule out alternatives. Any concern about baseline configuration (e.g., AutoDAN's published ASR) is an empirical correctness question, not circularity. Therefore no circular step is exhibited.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The reported attack rates depend on hand-chosen hyperparameters, especially suffix length, and on two domain assumptions: the target-affirmative loss transfers to useful harmful output, and self-reflective decoding preserves the adversarial signal. No new physical or architectural entities are introduced; the latent suffix is a vector in the existing embedding space.

free parameters (5)
  • suffix length L = 200 (ablated 50, 100, 200, 300)
    Hand-chosen default; Table 6 shows ASR rises from 13% at 50 to 65% at 300, so the central ASR numbers are sensitive to this choice.
  • target affirmative response y* = "Sure, here is..."
    Hand-chosen target for the cross-entropy loss; it resembles the affirmative/refusal keyword success criterion, so the optimization objective and evaluation are aligned by construction.
  • optimizer hyperparameters = learning rate 1e-3, weight decay 0.001
    Section 3.1 fixes these without sensitivity analysis.
  • universal batch size B = 10
    Section 2.2 states it 'empirically suffices'; no ablation is provided.
  • max refinement iterations T = 15
    Stopping bound; average successful attack needs 6.4 iterations, so this cap can affect reported ASR.
assumptions (4)
  • domain assumption Cross-entropy minimization toward a fixed affirmative target y* induces refusal-free harmful behavior
    Section 2.1.1 uses L(z)=CrossEntropy(Model([q;z]), y*); this assumes increasing likelihood of 'Sure, here is...' also increases useful harmful content.
  • domain assumption Self-reflective decoding preserves the adversarial objective in discrete text
    Section 2.1.2 and Algorithm 1 line 4 rely on the model's completion of the chat template retaining the optimized latent's effect. Only empirical ASR on tested models supports this.
  • domain assumption Keyword-based ASR with manually extracted keywords is a valid success metric
    Section 3.4 defines keyword extraction; alignment with StrongREJECT is shown for one model-dataset pair only.
  • domain assumption GPT-2 perplexity is a valid fluency and stealth proxy
    Used throughout to claim stealth; no perplexity-based defense is evaluated end to end.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs." pith.science (2026). https://pith.science/paper/X4NSOE73

@misc{pith2026250510838,
  author       = {Pith},
  title        = {Pith review of: LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X4NSOE73}},
  note         = {Machine review of arXiv:2505.10838}
}
read the original abstract

Efficient red-teaming method to uncover vulnerabilities in Large Language Models (LLMs) is crucial. While recent attacks often use LLMs as optimizers, the discrete language space make gradient-based methods struggle. We introduce LARGO (Latent Adversarial Reflection through Gradient Optimization), a novel latent self-reflection attack that reasserts the power of gradient-based optimization for generating fluent jailbreaking prompts. By operating within the LLM's continuous latent space, LARGO first optimizes an adversarial latent vector and then recursively call the same LLM to decode the latent into natural language. This methodology yields a fast, effective, and transferable attack that produces fluent and stealthy prompts. On standard benchmarks like AdvBench and JailbreakBench, LARGO surpasses leading jailbreaking techniques, including AutoDAN, by 44 points in attack success rate. Our findings demonstrate a potent alternative to agentic LLM prompting, highlighting the efficacy of interpreting and attacking LLM internals through gradient optimization.

Figures

Figures reproduced from arXiv: 2505.10838 by the authors.

Figure 1
Figure 1. Examples of adversarial suffixes generated by LARGO under single-prompt and multi [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Optimization trace of a single adversarial suffix. As shown by the loss graph, our algorithm [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of our three-staged algorithm. We first optimize a continuous embedding in the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Examples of successful jailbreaks generated by LARGO. Exact suffixes truncated. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks

    cs.AI 2025-10 conditional novelty 5.0 of 10

    Fine-tuning an LLM on synthetic toxic dialogues makes it harass in 95–97% of multi-turn conversations in Llama and ~99% in Gemini; memory and planning attacks also raise closed-source vulnerability.

Reference graph

Works this paper leans on

23 extracted references · 3 canonical work pages · cited by 1 Pith paper

  1. [1]

    Phi-3 technical report: A highly capable language model locally on your phone

    Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, et al. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219,

    arXiv

  2. [4]

    Jailbreaking black box large language models in twenty queries

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419,

    arXiv

  3. [5]

    Jailbreakbench: An open robustness benchmark for jailbreaking large language models

    Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. arXiv preprint arXiv:2404.01318,

    arXiv

  4. [6]

    h4rm3l: A dynamic benchmark of composable jailbreak attacks for llm safety assessment

    Moussa Koulako Bala Doumbouya, Ananjan Nandi, Gabriel Poesia, Davide Ghilardi, Anna Goldie, Federico Bianchi, Dan Jurafsky, and Christopher D Manning. h4rm3l: A dynamic benchmark of composable jailbreak attacks for llm safety assessment. arXiv preprint arXiv:2408.04811,

    arXiv

  5. [8]

    The ethics of interaction: Mitigating security threats in llms

    Ashutosh Kumar, Shiv Vignesh Murthy, Sagarika Singh, and Swathy Ragupathy. The ethics of interaction: Mitigating security threats in llms. arXiv preprint arXiv:2401.12273,

    arXiv

  6. [9]

    Safety layers in aligned large language models: The key to llm security

    Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. Safety layers in aligned large language models: The key to llm security. arXiv preprint arXiv:2408.17003,

    arXiv

  7. [10]

    do anything now

    Seyedsina Nabavirazavi, Samira Zad, and Sundararaja Sitharama Iyengar. Evaluating the universality of “do anything now” jailbreak prompts on large language models: Content warning: This paper contains unfiltered and harmful examples. In 2025 IEEE 15th Annual Computing and Communication Workshop and Conference (CCWC), pages 00691–00696. IEEE,

    work page 2025

  8. [11]

    Latentqa: Teaching llms to decode activations into natural language

    Alexander Pan, Lijie Chen, and Jacob Steinhardt. Latentqa: Teaching llms to decode activations into natural language. arXiv preprint arXiv:2412.08686,

    arXiv

Show all 23 references
  1. [12]

    Ad- vprompter: Fast adaptive adversarial prompting for llms

    10 Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. Ad- vprompter: Fast adaptive adversarial prompting for llms. arXiv preprint arXiv:2404.16873,

    arXiv

  2. [13]

    Xstest: A test suite for identifying exaggerated safety behaviours in large language models

    Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association fo...

    2024

  3. [14]

    Code llama: Open foundation models for code

    Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, et al. Code llama: Open foundation models for code. arXiv preprint arXiv:2308.12950,

    arXiv

  4. [15]

    Scalable and transferable black-box jailbreaks for language models via persona modulation

    Rusheb Shah, Soroush Pour, Arush Tagade, Stephen Casper, Javier Rando, et al. Scalable and transferable black-box jailbreaks for language models via persona modulation. arXiv preprint arXiv:2311.03348,

    arXiv

  5. [16]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceed- ings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages 1...

    2024

  6. [17]

    A strongreject for empty jailbreaks

    Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, et al. A strongreject for empty jailbreaks. arXiv preprint arXiv:2402.10260,

    arXiv

  7. [18]

    Codegemma: Open code models based on gemma

    CodeGemma Team, Heri Zhao, Jeffrey Hui, Joshua Howland, Nam Nguyen, Siqi Zuo, Andrea Hu, Christopher A Choquette-Choo, Jingyue Shen, Joe Kelley, et al. Codegemma: Open code models based on gemma. arXiv preprint arXiv:2406.11409,

    arXiv

  8. [19]

    Gemini: a family of highly capable multimodal models

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805,

    arXiv

  9. [20]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288,

    arXiv

  10. [21]

    Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253,

    arXiv

  11. [22]

    Diversity helps jailbreak large language models

    Weiliang Zhao, Daniel Ben-Levi, Junfeng Yang, and Chengzhi Mao. Diversity helps jailbreak large language models. arXiv preprint arXiv:2411.04223,

    arXiv

  12. [23]

    Universal and transferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043,

    arXiv

  13. [2022]

    Guard: Role-playing to generate natural-language jailbreakings to test guideline adherence of large language models

    Haibo Jin, Ruoxi Chen, Andy Zhou, Yang Zhang, and Haohan Wang. Guard: Role-playing to generate natural-language jailbreakings to test guideline adherence of large language models. arXiv preprint arXiv:2402.03299,

  14. [2023]

    Jailbreaking leading safety- aligned llms with simple adaptive attacks

    Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety- aligned llms with simple adaptive attacks. arXiv preprint arXiv:2404.02151,

    arXiv

  15. [2024]

    Detecting language model attacks with perplexity

    Gabriel Alon and Michael Kamfonas. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132,

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.