mlsanityData to 7 Oct 2026

LLMStinger: Jailbreaking LLMs using RL fine-tuned LLMs

arXiv 2411.08862 ↗First posted 13 Nov 2024cs.LG cs.CRcited by 5

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

We introduce LLMStinger, a novel approach that leverages Large Language Models (LLMs) to automatically generate adversarial suffixes for jailbreak attacks. Unlike traditional methods, which require complex prompt engineering or white-box access, LLMStinger uses a reinforcement learning (RL) loop to fine-tune an attacker LLM, generating new suffixes based on existing attacks for harmful questions from the HarmBench benchmark. Our method significantly outperforms existing red-teaming approaches (we compared against 15 of the latest methods), achieving a +57.2% improvement in Attack Success Rate (ASR) on LLaMA2-7B-chat and a +50.3% ASR increase on Claude 2, both models known for their extensive safety measures. Additionally, we achieved a 94.97% ASR on GPT-3.5 and 99.4% on Gemma-2B-it, demonstrating the robustness and adaptability of LLMStinger across open and closed-source models.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 18 of its 29 references that are in the map. First posted on arXiv 13 Nov 2024.

Builds on

18 of 29 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024Coercing LLMs to do and reveal (almost) anything21 Feb
  2. 2024Defending Jailbreak Prompts via In-Context Adversarial Game20 Feb
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  4. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  7. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 11

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2020Learning to summarize from human feedbackcited by 2,562
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  5. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  6. 2023Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyondcited by 409
  7. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 329
  8. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  9. 2023Evil Geniuses: Delving into the Safety of LLM-based Agentscited by 103
  10. 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attackscited by 78
  11. 2023BertRLFuzzer: A BERT and Reinforcement Learning Based Fuzzercited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 2.

5 papers.

  1. 2025REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objectivecited by 15
  2. 2026Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignmentcited by 6
  3. 2025Fight Fire with Fire: Defending Against Malicious RL Fine-Tuning via Reward Neutralizationcited by 3
  4. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  5. 2026TrailBlazer: History-Guided Reinforcement Learning for Black-Box LLM Jailbreakingcited by 1