mlsanityData to 14 Oct 2026

Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space

arXiv 2505.21277 ↗First posted 27 May 2025cs.CR cs.AI cs.CLcited by 17

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs), despite advanced general capabilities, still suffer from numerous safety risks, especially jailbreak attacks that bypass safety protocols. Understanding these vulnerabilities through black-box jailbreak attacks, which better reflect real-world scenarios, offers critical insights into model robustness. While existing methods have shown improvements through various prompt engineering techniques, their success remains limited against safety-aligned models, overlooking a more fundamental problem: the effectiveness is inherently bounded by the predefined strategy spaces. However, expanding this space presents significant challenges in both systematically capturing essential attack patterns and efficiently navigating the increased complexity. To better explore the potential of expanding the strategy space, we address these challenges through a novel framework that decomposes jailbreak strategies into essential components based on the Elaboration Likelihood Model (ELM) theory and develops genetic-based optimization with intention evaluation mechanisms. To be striking, our experiments reveal unprecedented jailbreak capabilities by expanding the strategy space: we achieve over 90% success rate on Claude-3.5 where prior methods completely fail, while demonstrating strong cross-model transferability and surpassing specialized safeguard models in evaluation accuracy. The code is open-sourced at: https://github.com/Aries-iai/CL-GSO.

Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 21 of its 57 references that are in the map. First posted on arXiv 27 May 2025.

Builds on

21 of 57 references.

Closest ancestors · 8

Same direction, newest first

  1. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  2. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  3. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  4. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  5. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  6. 2023Detecting Language Model Attacks with Perplexity27 Aug
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  8. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 13

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  6. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  7. 2022LM-Nav: Robotic Navigation with Large Pre-Trained Models of Language, Vision, and Actioncited by 439
  8. 2024Skywork-Reward: Bag of Tricks for Reward Modeling in LLMscited by 327
  9. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  10. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 191
  11. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 109
  12. 2025STAIR: Improving Safety Alignment with Introspective Reasoningcited by 77
1 more
  1. 2025RealSafe-R1: Safety-Aligned DeepSeek-R1 without Compromising Reasoning Capabilitycited by 59

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 9; 2026: 8.

17 papers.

Sort:

By area:

  1. 2025Mitigating Overthinking in Large Reasoning Models via Manifold Steeringcited by 33
  2. 2025A Survey on Autonomy-Induced Security Risks in Large Model-Based Agentscited by 29
  3. 2025Oyster-I: Beyond Refusal -- Constructive Safety Alignment for Responsible Language Modelscited by 19
  4. 2025DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarioscited by 19
  5. 2026Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Searchcited by 13
  6. 2025Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructionscited by 11
  7. 2025Towards Safe Reasoning in Large Reasoning Models via Corrective Interventioncited by 11
  8. 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attackcited by 5
  9. 2026Evolving Skill-Structured Attack Memory Enhances LLM Jailbreakingcited by 3
  10. 2025LLaVAShield: Safeguarding Multimodal Multi-Turn Dialogues in Vision-Language Modelscited by 1
  11. 2025Casting a SPELL: Sentence Pairing Exploration for LLM Limitation-breakingcited by 1
  12. 2026GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Modelscited by 1
5 more
  1. 2026Improving Safety Alignment via Balanced Direct Preference Optimizationcited by 1
  2. 2026Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMscited by 0
  3. 2026MESA: Improving MoE Safety Alignment via Decentralized Expertisecited by 0
  4. 2026UniNDM: A Unified Noise-driven Detection and Mitigation Framework Against Sexual Content in Text-to-Image Generationcited by 0
  5. 2026Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreakingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models
  2. 2025Stand on The Shoulders of Giants: Building JailExpert from Previous Attack Experience
  3. 2025ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs
  4. 2024JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs
  5. 2024Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models
  6. 2024Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models
  7. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization
  8. 2025Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints