mlsanityData to 14 Oct 2026

Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities

arXiv 2410.18469 ↗First posted 24 Oct 2024cs.CL cs.LGcited by 17

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Recent research has shown that Large Language Models (LLMs) are vulnerable to automated jailbreak attacks, where adversarial suffixes crafted by algorithms appended to harmful queries bypass safety alignment and trigger unintended responses. Current methods for generating these suffixes are computationally expensive and have low Attack Success Rates (ASR), especially against well-aligned models like Llama2 and Llama3. To overcome these limitations, we introduce ADV-LLM, an iterative self-tuning process that crafts adversarial LLMs with enhanced jailbreak ability. Our framework significantly reduces the computational cost of generating adversarial suffixes while achieving nearly 100% ASR on various open-source LLMs. Moreover, it exhibits strong attack transferability to closed-source models, achieving 99% ASR on GPT-3.5 and 49% ASR on GPT-4, despite being optimized solely on Llama3. Beyond improving jailbreak ability, ADV-LLM provides valuable insights for future safety alignment research through its ability to generate large datasets for studying LLM safety. Our code is available at: https://github.com/SunChungEn/ADV-LLM

Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 14 of its 19 references that are in the map. First posted on arXiv 24 Oct 2024.

Builds on

14 of 19 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 12

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  4. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  7. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  8. 2016Diverse Beam Search: Decoding Diverse Solutions from Neural Sequence Modelscited by 301
  9. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
  10. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMscited by 172
  11. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 88
  12. 2024Rapid Optimization for Jailbreaking LLMs via Subconscious Exploitation and Echopraxiacited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 7; 2026: 9.

17 papers.

Sort:

By area:

  1. 2024Large Language Model Safety: A Holistic Surveycited by 59
  2. 2025ThinkEdit: Interpretable Weight Editing to Mitigate Overly Short Thinking in Reasoning Modelscited by 17
  3. 2026SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attackscited by 12
  4. 2025Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraintscited by 11
  5. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steeringcited by 11
  6. 2025TRIDENT: Benchmarking LLM Safety in Finance, Medicine, and Lawcited by 8
  7. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safetycited by 8
  8. 2026Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Samplingcited by 6
  9. 2025Adversarial Attack-Defense Co-Evolution for LLM Safety Alignment via Tree-Group Dual-Aware Search and Optimizationcited by 4
  10. 2026Steer2Edit: From Activation Steering to Component-Level Editingcited by 2
  11. 2026GFlowRL: Scaling Distribution-Matching RL to Large Language Modelscited by 2
  12. 2025SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Modelscited by 1
5 more
  1. 2025ReFIne: A Framework for Trustworthy Large Reasoning Models with Reliability, Faithfulness, and Interpretabilitycited by 0
  2. 2026New Wide-Net-Casting Jailbreak Attacks Risk Large Modelscited by 0
  3. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attackcited by 0
  4. 2026The Cold-Start Safety Gap in LLM Agentscited by 0
  5. 2026From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scalingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024LLMStinger: Jailbreaking LLMs using RL fine-tuned LLMs
  2. 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
  3. 2025Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges
  4. 2024SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner
  5. 2025Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race?
  6. 2025Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence
  7. 2025Proactive defense against LLM Jailbreak
  8. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing