mlsanityData to 14 Oct 2026

LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs

arXiv 2505.10838 ↗First posted 16 May 2025cs.LG cs.CL cs.CRcited by 7

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Efficient red-teaming method to uncover vulnerabilities in Large Language Models (LLMs) is crucial. While recent attacks often use LLMs as optimizers, the discrete language space make gradient-based methods struggle. We introduce LARGO (Latent Adversarial Reflection through Gradient Optimization), a novel latent self-reflection attack that reasserts the power of gradient-based optimization for generating fluent jailbreaking prompts. By operating within the LLM's continuous latent space, LARGO first optimizes an adversarial latent vector and then recursively call the same LLM to decode the latent into natural language. This methodology yields a fast, effective, and transferable attack that produces fluent and stealthy prompts. On standard benchmarks like AdvBench and JailbreakBench, LARGO surpasses leading jailbreaking techniques, including AutoDAN, by 44 points in attack success rate. Our findings demonstrate a potent alternative to agentic LLM prompting, highlighting the efficacy of interpreting and attacking LLM internals through gradient optimization.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 23 of its 33 references that are in the map. First posted on arXiv 16 May 2025.

Builds on

23 of 33 references.

Closest ancestors · 13

Same direction, newest first

  1. 2024Diversity Helps Jailbreak Large Language Models6 Nov
  2. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs13 Jun
  3. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs21 Apr
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  5. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  6. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  7. 2024GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of Large Language Models5 Feb
  8. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation6 Nov
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  10. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  11. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  12. 2023Detecting Language Model Attacks with Perplexity27 Aug
1 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 10

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2023Code Llama: Open Foundation Models for Codecited by 2,139
  4. 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,917
  5. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  6. 2024CodeGemma: Open Code Models Based on Gemmacited by 150
  7. 2024Safety Layers in Aligned Large Language Models: The Key to LLM Securitycited by 134
  8. 2024SelfIE: Self-Interpretation of Large Language Model Embeddingscited by 67
  9. 2024LatentQA: Teaching LLMs to Decode Activations Into Natural Languagecited by 51
  10. 2024The Ethics of Interaction: Mitigating Security Threats in LLMscited by 33

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 5.

7 papers.

  1. 2026Unsafe by Reciprocity: How Generation-Understanding Coupling Undermines Safety in Unified Multimodal Modelscited by 2
  2. 2025Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attackscited by 1
  3. 2026Efficient Refusal Ablation in LLM through Optimal Transportcited by 1
  4. 2025Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attackscited by 0
  5. 2026Jailbreaking LLMs via Calibrationcited by 0
  6. 2026LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Modelscited by 0
  7. 2026LLM Alignment--Utility Asymmetry under Semantic-Preserving Transformationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMs
  2. 2025LatentBreak: Jailbreaking Large Language Models through Latent Space Feedback
  3. 2024GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs
  4. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models
  5. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
  6. 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
  7. 2024Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation
  8. 2026Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Models