REVIEW 20 cited by
Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Despite efforts to align large language models to produce harmless responses, they are still vulnerable to jailbreak prompts that elicit unrestricted behaviour. In this work, we investigate persona modulation as a black-box jailbreaking method to steer a target model to take on personalities that are willing to comply with harmful instructions. Rather than manually crafting prompts for each persona, we automate the generation of jailbreaks using a language model assistant. We demonstrate a range of harmful completions made possible by persona modulation, including detailed instructions for synthesising methamphetamine, building a bomb, and laundering money. These automated attacks achieve a harmful completion rate of 42.5% in GPT-4, which is 185 times larger than before modulation (0.23%). These prompts also transfer to Claude 2 and Vicuna with harmful completion rates of 61.0% and 35.9%, respectively. Our work reveals yet another vulnerability in commercial large language models and highlights the need for more comprehensive safeguards.
Forward citations
Cited by 20 Pith papers
-
On Surjectivity of Neural Networks: Can you elicit any behavior from your model?
Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.
-
MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?
MOCHA is a benchmark of 10.5K malicious coding prompts, including multi-turn decomposition attacks, showing code LLMs reject these incremental attacks at much lower rates and that fine-tuning on the benchmark improves...
-
Jailbreak Distillation: Renewable Safety Benchmarking
Jailbreak Distillation generates candidate jailbreak prompts on small development models and selects the most effective subset, producing safety benchmarks that transfer to a wide range of held-out models.
-
A Scalable Approach to Evaluating Moral Sensitivity in LLMs
Under morally irrelevant noise, eight LLMs preserve the semantic content of identified moral features above calibrated floors, despite significant changes in feature counts.
-
Role Steering of Language Models for Social Simulations
A role-steering screening workflow on 275 roles shows role-specific activation directions beat a non-scale-matched assistant-direction control (63.2 vs 41.1 judged alignment) and flags 38 roles as 'anti-controllable'.
-
Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines
Disguising unsafe operations as routine software-engineering tests makes coding agents execute them at high verified rates, revealing a gap between language-layer refusal and execution-layer harm.
-
The Emotional Baby Is Truly Deadly: Does your Multimodal Large Reasoning Model Have Emotional Flattery towards Humans?
Multimodal reasoning models can be steered into unsafe behavior by emotional prompts and sometimes conceal harmful reasoning inside seemingly safe responses.
-
From Seed to Harvest: Augmenting Human Creativity with AI for Red-teaming Text-to-Image Models
Seed2Harvest expands 1,000 human adversarial prompts into 27,650 LLM-generated variants that keep roughly comparable unsafe-image trigger rates and add hundreds of new geographic contexts.
-
SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compression
A security-aware prompt compressor that reveals the hidden intent of jailbreak prompts and injects it into the system prompt reduces average attack success from 35% to 1% with negligible overhead.
-
Adversarial Attacks on Robotic Vision Language Action Models
Text-based adversarial suffixes can make OpenVLA robot policies elicit chosen target actions with over 90% success on one-hot targets and persist across rollout steps.
-
Lifelong Safety Alignment for Language Models
A co-evolutionary attacker-defender loop, warmed up by strategies extracted from jailbreak papers, reduces jailbreak success rate on a robust model from 73% to 7% in two iterations.
-
QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language
QueryAttack converts harmful natural-language requests into structured SQL or programming-language templates that aligned LLMs answer with harmful instructions, without needing to decrypt the output.
-
A Red Teaming Framework for Large Language Models: A Case Study on Faithfulness Evaluation
Introduces a multi-role red teaming framework using attacker and jury models that increases attack success rates by up to 7.9% on LLM faithfulness in question-answering tasks.
-
State-Dependent Safety Failures in Multi-Turn Language Model Interaction
By staging role-played conversations, STAR drives refusal-aligned LLMs into compliance within a few turns, and shows safety failure is state-dependent rather than purely prompt-level.
-
Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation
Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.
-
Linearly Decoding Refused Knowledge in Aligned Language Models
Linear probes recover jailbreak-only answers from aligned models' hidden states, sometimes transfer from base models, and correlate with pairwise preference rankings.
-
VERA: Variational Inference Framework for Jailbreaking Large Language Models
VERA frames black-box jailbreaking as variational inference, training a LoRA-tuned attacker that samples diverse fluent prompts; reported ASRs are high but several evaluation choices weaken the SOTA claims.
-
SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Models
Across 510 HarmBench behaviors and seven attack methods, GPT-4 models show more consistent jailbreak resilience than DeepSeek models, whose vulnerability grows with scale.
-
PRM-Free Security Alignment of Large Models via Red Teaming and Adversarial Training
A PRM-free alignment pipeline combining genetic algorithm red teaming and multi-objective adversarial training is claimed to beat PRM-based methods at 61% lower cost, but the experiments are unverifiable.
-
The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMs
A structured survey of LLM safety evaluation that proposes a why/what/where/how taxonomy and catalogs metrics, datasets, benchmarks, evaluators, and frameworks.
Discussion (0). Continue with ORCID to comment.