mlsanityData to 7 Oct 2026

Towards Universal and Black-Box Query-Response Only Attack on LLMs with QROA

arXiv 2406.02044 ↗First posted 4 Jun 2024cs.CL cs.LGcited by 3

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

The rapid adoption of Large Language Models (LLMs) has exposed critical security and ethical vulnerabilities, particularly their susceptibility to adversarial manipulations. This paper introduces QROA, a novel black-box jailbreak method designed to identify adversarial suffixes that can bypass LLM alignment safeguards when appended to a malicious instruction. Unlike existing suffix-based jailbreak approaches, QROA does not require access to the model's logit or any other internal information. It also eliminates reliance on human-crafted templates, operating solely through the standard query-response interface of LLMs. By framing the attack as an optimization bandit problem, QROA employs a surrogate model and token level optimization to efficiently explore suffix variations. Furthermore, we propose QROA-UNV, an extension that identifies universal adversarial suffixes for individual models, enabling one-query jailbreaks across a wide range of instructions. Testing on multiple models demonstrates Attack Success Rate (ASR) greater than 80%. These findings highlight critical vulnerabilities, emphasize the need for advanced defenses, and contribute to the development of more robust safety evaluations for secure AI deployment. The code is made public on the following link: https://github.com/qroa/QROA

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 30 of its 47 references that are in the map. First posted on arXiv 4 Jun 2024.

Builds on

30 of 47 references.

Closest ancestors · 14

Same direction, newest first

  1. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  2. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models21 Feb
  3. 2024Query-Based Adversarial Prompt Generation19 Feb
  4. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs8 Feb
  5. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  6. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily14 Nov
  7. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  8. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  9. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  10. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  11. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Models4 Sep
  12. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
2 more
  1. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 16

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  4. 2023Mistral 7Bcited by 3,065
  5. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  7. 2021Ethical and social risks of harm from Language Modelscited by 957
  8. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  9. 2023The Falcon Series of Open Language Modelscited by 526
  10. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 329
  11. 2023Are aligned neural networks adversarially aligned?cited by 305
  12. 2023Pretraining Language Models with Human Preferencescited by 245
4 more
  1. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  2. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  3. 2015Deep Reinforcement Learning in Large Discrete Action Spacescited by 158
  4. 2022PromptAttack: Prompt-based Attack for Language Models via Gradient Searchcited by 15

Built on by

Cited by year

Citing papers per year: 2024: 2; 2025: 1.

3 papers.

  1. 2024Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroringcited by 10
  2. 2024Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerationscited by 8
  3. 2025Black-box Optimization of LLM Outputs by Asking for Directionscited by 7

Similar, not cited

Close in wording, no citation either way

  1. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs
  2. 2025Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers
  3. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  4. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM
  5. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  6. 2024Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models
  7. 2024An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer
  8. 2024Jailbreaking Large Language Models Through Alignment Vulnerabilities in Out-of-Distribution Settings