mlsanityData to 7 Oct 2026

When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search

arXiv 2406.08705 ↗First posted 13 Jun 2024cs.CRcited by 42

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Recent studies developed jailbreaking attacks, which construct jailbreaking prompts to fool LLMs into responding to harmful questions. Early-stage jailbreaking attacks require access to model internals or significant human efforts. More advanced attacks utilize genetic algorithms for automatic and black-box attacks. However, the random nature of genetic algorithms significantly limits the effectiveness of these attacks. In this paper, we propose RLbreaker, a black-box jailbreaking attack driven by deep reinforcement learning (DRL). We model jailbreaking as a search problem and design an RL agent to guide the search, which is more effective and has less randomness than stochastic search, such as genetic algorithms. Specifically, we design a customized DRL system for the jailbreaking problem, including a novel reward function and a customized proximal policy optimization (PPO) algorithm. Through extensive experiments, we demonstrate that RLbreaker is much more effective than existing jailbreaking attacks against six state-of-the-art (SOTA) LLMs. We also show that RLbreaker is robust against three SOTA defenses and its trained agents can transfer across different LLMs. We further validate the key design choices of RLbreaker via a comprehensive ablation study.

Key facts. Cited by 42 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. First posted on arXiv 13 Jun 2024.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 22; 2026: 16.

42 papers.

Sort:

By area:

  1. 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 194
  2. 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agentscited by 42
  3. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  4. 2024PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMscited by 20
  5. 2024PROMPTFUZZ: Harnessing Fuzzing Techniques for Robust Testing of Prompt Injection in LLMscited by 17
  6. 2025SoK: Evaluating Jailbreak Guardrails for Large Language Modelscited by 17
  7. 2024LeakAgent: RL-based Red-teaming Agent for LLM Privacy Leakagecited by 13
  8. 2026Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Searchcited by 10
  9. 2024PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approachcited by 9
  10. 2025When Style Breaks Safety: Defending LLMs Against Superficial Style Alignmentcited by 6
  11. 2025ASTRA: Autonomous Spatial-Temporal Red-teaming for AI Software Assistantscited by 6
  12. 2025Dynamics of Adversarial Attacks on Large Language Model-Based Search Enginescited by 5
30 more
  1. 2025TurboFuzzLLM: Turbocharging Mutation-based Fuzzing for Effectively Jailbreaking Large Language Models in Practicecited by 5
  2. 2025Sugar-Coated Poison: Benign Generation Unlocks LLM Jailbreakingcited by 5
  3. 2025OMNIGUARD: An Efficient Approach for AI Safety Moderation Across Languages and Modalitiescited by 5
  4. 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?cited by 5
  5. 2025Active Attacks: Red-teaming LLMs via Adaptive Environmentscited by 5
  6. 2025VERA: Variational Inference Framework for Jailbreaking Large Language Modelscited by 4
  7. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 4
  8. 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
  9. 2026TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreakingcited by 4
  10. 2025MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuningcited by 3
  11. 2026Beyond Rewards in Reinforcement Learning for Cyber Defencecited by 3
  12. 2025NonTextual Target Attackcited by 2
  13. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Modelscited by 2
  14. 2026ADR: An Agentic Detection System for Enterprise Agentic AI Securitycited by 2
  15. 2025MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMscited by 1
  16. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  17. 2025Casting a SPELL: Sentence Pairing Exploration for LLM Limitation-breakingcited by 1
  18. 2025Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Modelscited by 1
  19. 2026TrailBlazer: History-Guided Reinforcement Learning for Black-Box LLM Jailbreakingcited by 1
  20. 2026Risk-Adjusted Harm Scoring for Automated Red Teaming for LLMs in Financial Servicescited by 1
  21. 2026FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Modelscited by 1
  22. 2025Evaluating Multi-Agent Defences Against Jailbreaking Attacks on Large Language Modelscited by 0
  23. 2025SoK: a Comprehensive Causality Analysis Framework for Large Language Model Securitycited by 0
  24. 2026One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intentcited by 0
  25. 2026A Systematic Investigation of RL-Jailbreaking in LLMscited by 0
  26. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoringcited by 0
  27. 2026LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Modelscited by 0
  28. 2026Improving Generalization Robustness of Multimodal RLVRcited by 0
  29. 2026Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoningcited by 0
  30. 2026AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agentscited by 0