TLDR: A new gradient-based untargeted jailbreak attack (UJA) is proposed to bypass Large Language Model (LLM) safety mechanisms. Unlike previous methods that aim for predefined harmful responses, UJA maximizes the probability of any unsafe response, significantly expanding the attack’s search space. It uses a two-stage optimization process: first, finding an optimal harmful response, and then, crafting an adversarial prompt to elicit it. UJA achieves over 80% attack success rates with fewer iterations, outperforms state-of-the-art attacks, and is robust against defenses, revealing broader LLM vulnerabilities.
Large Language Models (LLMs) are powerful, but they face significant security challenges, particularly from “jailbreak attacks.” These attacks involve crafting special prompts to bypass safety mechanisms and make LLMs generate unsafe or malicious content. Traditionally, these prompts were made manually, but now, automated gradient-based methods are gaining attention for their effectiveness in finding vulnerabilities.
Most existing automated jailbreak attacks, like Greedy Coordinate Gradient (GCG) and COLD-Attack, work by trying to make the LLM produce a specific, predefined target response, such as “Sure, here is…” This approach, while effective to some extent, has a major drawback: it severely limits the possible adversarial prompts that can be found. Because the target is fixed, the attack might miss other ways to elicit harmful responses, and it often requires many attempts to succeed, making it inefficient.
To overcome these limitations, a new method called the Untargeted Jailbreak Attack (UJA) has been proposed by researchers Xinzhe Huang, Wenjing Hu, Tianhang Zheng, Kedong Xiu, Xiaojun Jia, Di Wang, Zhan Qin, and Kui Ren. UJA is the first gradient-based untargeted jailbreak attack, meaning it aims to get an unsafe response from an LLM without forcing it to follow any specific pattern. This significantly broadens the search space for vulnerabilities, making the attack more flexible and efficient.
UJA works by maximizing the “unsafety probability” of an LLM’s response, which is measured by a separate “judge model.” Since this objective is complex, UJA breaks it down into two manageable stages. The first stage focuses on finding the most harmful possible response. It starts with a typical refusal response from the LLM and then iteratively modifies it to become as unsafe as possible, while still remaining semantically plausible. This stage uses the judge model to guide the optimization towards highly unsafe outputs.
The second stage then takes this optimal harmful response and works backward to find an adversarial prompt that will make the target LLM produce that response. A key challenge here is that the judge model and the target LLM might use different ways to break down text into “tokens.” UJA addresses this by using a “gradient projection” technique to effectively transfer the adversarial signal between these different token spaces, ensuring the prompt optimization is accurate.
Extensive evaluations show that UJA is highly effective. It achieved over 80% attack success rates against recent safety-aligned LLMs with only 100 optimization iterations. This performance significantly surpasses state-of-the-art gradient-based attacks like I-GCG and COLD-Attack by more than 20%. For instance, on the AdvBench dataset, UJA achieved an average Attack Success Rate (ASR) of 71.9% with 100 iterations, outperforming COLD-Attack by 23.5%.
Beyond its high success rate, UJA also demonstrates superior efficiency and transferability. It converges faster, achieving most successes in early optimization steps, and maintains effectiveness when transferred to more advanced LLMs like Llama3-70B and DeepSeek-R1. The method also generates a wider variety of harmful responses, indicating it uncovers a broader range of LLM vulnerabilities compared to methods that stick to fixed response templates.
Also Read:
- Adaptive Risk Control for Secure and Efficient LLM In-Context Learning
- Unmasking AI Vulnerabilities: A New Approach to Multimodal Safety Testing
Furthermore, UJA proved robust against various defense mechanisms, including Perplexity filters, SmoothLLM, and Paraphrase defenses, consistently showing higher post-defense attack success rates than other methods. This research highlights a significant advancement in understanding and exploiting LLM vulnerabilities, paving the way for more robust safety mechanisms. You can find more details about this research paper here.
