mlsanityData to 7 Oct 2026

LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds

arXiv 2412.05232 ↗First posted 6 Dec 2024cs.CLcited by 3

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Jailbreak attacks expose vulnerabilities in safety-aligned LLMs by eliciting harmful outputs through carefully crafted prompts. Existing methods rely on discrete optimization or trained adversarial generators, but are slow, compute-intensive, and often impractical. We argue that these inefficiencies stem from a mischaracterization of the problem. Instead, we frame jailbreaks as inference-time misalignment and introduce LIAR (Leveraging Inference-time misAlignment to jailbReak), a fast, black-box, best-of-N sampling attack requiring no training. LIAR matches state-of-the-art success rates while reducing perplexity by 10× and Time-to-Attack from hours to seconds. We also introduce a theoretical "safety net against jailbreaks" metric to quantify safety alignment strength and derive suboptimality bounds. Our work offers a simple yet effective tool for evaluating LLM robustness and advancing alignment research.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 70 of its 85 references that are in the map. First posted on arXiv 6 Dec 2024.

Builds on

70 of 85 references.

Closest ancestors · 25

Same direction, newest first

  1. 2024Best-of-N Jailbreaking4 Dec
  2. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment27 Nov
  3. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMs2 Aug
  4. 2024Don't Say No: Jailbreaking LLM by Suppressing Refusal25 Apr
  5. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs21 Apr
  6. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  7. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  8. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  9. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  10. 2024PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails24 Feb
  11. 2024Query-Based Adversarial Prompt Generation19 Feb
  12. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
13 more
  1. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  2. 2024Weak-to-Strong Jailbreaking on Large Language Models30 Jan
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  4. 2023Analyzing the Inherent Response Tendency of LLMs: Real-World Instructions-Driven Jailbreak7 Dec
  5. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models23 Oct
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  7. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  8. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  9. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  10. 2023Detecting Language Model Attacks with Perplexity27 Aug
  11. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  12. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  13. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 45

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Deep reinforcement learning from human preferencescited by 3,846
  8. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,769
  9. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  10. 2023Mistral 7Bcited by 3,065
  11. 2016Pointer Sentinel Mixture Modelscited by 2,992
  12. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
33 more
  1. 2019Fine-Tuning Language Models from Human Preferencescited by 2,124
  2. 2019Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelismcited by 1,829
  3. 2023Pythia: A Suite for Analyzing Large Language Models Across Training and Scalingcited by 1,734
  4. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  5. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  7. 2023The RefinedWeb Dataset for Falcon LLM: Outperforming Curated Corpora with Web Data, and Web Data Onlycited by 755
  8. 2020Aligning AI With Shared Human Valuescited by 706
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  10. 2022Improving alignment of dialogue agents via targeted human judgementscited by 527
  11. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 368
  12. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 329
  13. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  14. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  15. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  16. 2023Pretraining Language Models with Human Preferencescited by 245
  17. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  18. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  19. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  20. 2023Fundamental Limitations of Alignment in Large Language Modelscited by 152
  21. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  22. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  23. 2024Theoretical guarantees on the best-of-n alignment policycited by 116
  24. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  25. 2024Self-Improvement in Language Models: The Sharpening Mechanismcited by 102
  26. 2024Curiosity-driven Red-teaming for Large Language Modelscited by 83
  27. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 81
  28. 2022Neuro-Symbolic Language Modeling with Automaton-augmented Retrievalcited by 60
  29. 2024Variational Best-of-N Alignmentcited by 49
  30. 2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 46
  31. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  32. 2023Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMscited by 26
  33. 2024A Chinese Dataset for Evaluating the Safeguards in Large Language Modelscited by 11

Built on by

Cited by year

Citing papers per year: 2025: 3.

3 papers.

  1. 2025Adversarial Reasoning at Jailbreaking Timecited by 27
  2. 2025Security Concerns for Large Language Models: A Surveycited by 26
  3. 2025AutoDAN-Reasoning: Enhancing Strategies Exploration based Jailbreak Attacks with Test-Time Scalingcited by 3

Similar, not cited

Close in wording, no citation either way

  1. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
  2. 2026Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs
  3. 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
  4. 2026Jailbreaking LLMs via Calibration
  5. 2025Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges
  6. 2026LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignment
  7. 2025Efficient Safety Retrofitting Against Jailbreaking for LLMs
  8. 2025Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction