mlsanityData to 7 Oct 2026

GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation

arXiv 2405.13077 ↗First posted 21 May 2024cs.CR cs.AI cs.CLcited by 24

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Research on jailbreaking has been valuable for testing and understanding the safety and security issues of large language models (LLMs). In this paper, we introduce Iterative Refinement Induced Self-Jailbreak (IRIS), a novel approach that leverages the reflective capabilities of LLMs for jailbreaking with only black-box access. Unlike previous methods, IRIS simplifies the jailbreaking process by using a single model as both the attacker and target. This method first iteratively refines adversarial prompts through self-explanation, which is crucial for ensuring that even well-aligned LLMs obey adversarial instructions. IRIS then rates and enhances the output given the refined prompt to increase its harmfulness. We find that IRIS achieves jailbreak success rates of 98% on GPT-4, 92% on GPT-4 Turbo, and 94% on Llama-3.1-70B in under 7 queries. It significantly outperforms prior approaches in automatic, black-box, and interpretable jailbreaking, while requiring substantially fewer queries, thereby establishing a new standard for interpretable jailbreaking methods.

Key facts. Cited by 24 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 12 of its 22 references that are in the map. First posted on arXiv 21 May 2024.

Builds on

12 of 22 references.

Closest ancestors · 8

Same direction, newest first

  1. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  2. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  4. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  5. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  6. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  8. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 4

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2023Bias and Fairness in Large Language Models: A Surveycited by 626
  3. 2018Adversarial Attacks and Defences: A Surveycited by 259
  4. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 6; 2025: 13; 2026: 5.

24 papers.

Sort:

By area:

  1. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 73
  2. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
  3. 2024JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Frameworkcited by 44
  4. 2025Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judgescited by 19
  5. 2024Legilimens: Practical and Unified Content Moderation for Large Language Model Servicescited by 13
  6. 2025Large Reasoning Models Are Autonomous Jailbreak Agentscited by 12
  7. 2024Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerationscited by 8
  8. 2025Improving Large Language Model Safety with Contrastive Representation Learningcited by 7
  9. 2025From ASR to ASP: Evaluating Prompt Attack Vulnerabilities Against Open-Source LLMscited by 6
  10. 2025Activation Reward Models for Few-Shot Model Alignmentcited by 6
  11. 2025Stand on The Shoulders of Giants: Building JailExpert from Previous Attack Experiencecited by 5
  12. 2024Reducing Reasoning Costs: The Path of Optimization for Chain of Thought via Sparse Attention Mechanismcited by 4
12 more
  1. 2025Geneshift: Impact of different scenario shift on Jailbreaking LLMcited by 4
  2. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 4
  3. 2025BitBypass: A New Direction in Jailbreaking Aligned Large Language Models with Bitstream Camouflagecited by 2
  4. 2025EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models via Equation Solving and Code Completioncited by 2
  5. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Modelscited by 2
  6. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  7. 2026Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Headscited by 1
  8. 2026Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Modelscited by 1
  9. 2026The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systemscited by 1
  10. 2025AJF: Adaptive Jailbreak Framework Based on the Comprehension Ability of Black-Box Large Language Modelscited by 0
  11. 2025When Harmless Words Harm: A New Threat to LLM Safety via Conceptual Triggerscited by 0
  12. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputscited by 0