mlsanityData to 7 Oct 2026

AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs

arXiv 2410.05295 ↗First posted 3 Oct 2024cs.CR cs.AI cs.LGcited by 185

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo.

Key facts. Cited by 185 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 20 of its 49 references that are in the map. First posted on arXiv 3 Oct 2024.

Builds on

20 of 49 references.

Closest ancestors · 15

Same direction, newest first

  1. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  2. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  3. 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models26 Feb
  4. 2024Foot In The Door: Understanding Large Language Model Jailbreaking via Cognitive Psychology24 Feb
  5. 2024GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of Large Language Models5 Feb
  6. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  7. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  8. 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking16 Nov
  9. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  10. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  11. 2023FuzzLLM: A Novel and Universal Fuzzing Framework for Proactively Discovering Jailbreak Vulnerabilities in Large Language Models11 Sep
  12. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
3 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  2. 2023Latent Jailbreak: A Benchmark for Evaluating Text Safety and Output Robustness of Large Language Models17 Jul
  3. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 5

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  3. 2022Text Embeddings by Weakly-Supervised Contrastive Pre-trainingcited by 1,216
  4. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 197
  5. 2023From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?cited by 53

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 79; 2026: 102.

185 papers.

Sort:

By area:

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  2. 2025The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1cited by 89
  3. 2025Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safetycited by 38
  4. 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 38
  5. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 30
  6. 2025Adversarial Reasoning at Jailbreaking Timecited by 27
  7. 2025Toward Generalizable Evaluation in the LLM Era: A Survey Beyond Benchmarkscited by 26
  8. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Modelscited by 23
  9. 2025SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systemscited by 23
  10. 2025Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competitioncited by 22
  11. 2025Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attackscited by 20
  12. 2025SafeKey: Amplifying Aha-Moment Insights for Safety Reasoningcited by 20
38 more
  1. 2026MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attackscited by 18
  2. 2026MAGIC: A Co-Evolving Attacker-Defender Adversarial Game for Robust LLM Safetycited by 15
  3. 2025Doxing via the Lens: Revealing Location-related Privacy Leakage on Multi-modal Large Reasoning Modelscited by 14
  4. 2025Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidencecited by 13
  5. 2025Lifelong Safety Alignment for Language Modelscited by 13
  6. 2024GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMscited by 12
  7. 2026AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMscited by 12
  8. 2025AISafetyLab: A Comprehensive Framework for AI Safety Evaluation and Improvementcited by 11
  9. 2025Adversarial Tokenizationcited by 11
  10. 2025CoP: Agentic Red-teaming for Large Language Models using Composition of Principlescited by 11
  11. 2025TROJail: Trajectory-Level Optimization for Multi-Turn Large Language Model Jailbreaks with Process Rewardscited by 11
  12. 2025Jailbreak Attack Initializations as Extractors of Compliance Directionscited by 10
  13. 2025StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimizationcited by 10
  14. 2025RainbowPlus: Enhancing Adversarial Prompt Generation via Evolutionary Quality-Diversity Searchcited by 10
  15. 2025Jailbreaking on Text-to-Video Models via Scene Splitting Strategycited by 10
  16. 2026Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Searchcited by 10
  17. 2026PIArena: A Platform for Prompt Injection Evaluationcited by 10
  18. 2024AmpleGCG-Plus: A Strong Generative Model of Adversarial Suffixes to Jailbreak LLMs with Higher Success Rates in Fewer Attemptscited by 9
  19. 2025Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderationcited by 9
  20. 2025GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methodscited by 9
  21. 2025Using Mechanistic Interpretability to Craft Adversarial Attacks against Large Language Modelscited by 9
  22. 2025AgenticEval: Toward Agentic and Self-Evolving Safety Evaluation of Large Language Modelscited by 9
  23. 2025SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinationscited by 9
  24. 2025Quality-Diversity Red-Teaming: Automated Generation of High-Quality and Diverse Attackers for Large Language Modelscited by 8
  25. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Modelscited by 8
  26. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoningcited by 8
  27. 2025RedCoder: Automated Multi-Turn Red Teaming for Code LLMscited by 8
  28. 2025PersonaTeaming: Exploring How Introducing Personas Can Improve Automated AI Red-Teamingcited by 8
  29. 2025Tree-based Dialogue Reinforced Policy Optimization for Red-Teaming Attackscited by 8
  30. 2026Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Modelscited by 8
  31. 2025AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Modelscited by 7
  32. 2025Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMscited by 7
  33. 2026Understanding and Preserving Safety in Fine-Tuned LLMscited by 7
  34. 2025Bypassing Prompt Guards in Production with Controlled-Release Promptingcited by 6
  35. 2025Adversarial D'ej`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attackscited by 6
  36. 2026Knowledge-Driven Multi-Turn Jailbreaking on Large Language Modelscited by 6
  37. 2026Be Your Own Red Teamer: Safety Alignment via Self-Play and Reflective Experience Replaycited by 6
  38. 2026Estimating Tail Risks in Language Model Output Distributionscited by 6

50 most cited of 185 All 185 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025AutoDAN-Reasoning: Enhancing Strategies Exploration based Jailbreak Attacks with Test-Time Scaling
  2. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks
  3. 2025Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learning
  4. 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
  5. 2026SRTJ: Self-Evolving Rule-Driven Training-Free LLM Jailbreaking
  6. 2025ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs
  7. 2025"To Survive, I Must Defect": Jailbreaking LLMs via the Game-Theory Scenarios
  8. 2024SeqAR: Jailbreak LLMs with Sequential Auto-Generated Characters