mlsanityData to 14 Oct 2026

Universal Jailbreak Suffixes Are Strong Attention Hijackers

arXiv 2506.12880 ↗First posted 15 Jun 2025cs.CRcited by 10

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

We study suffix-based jailbreaksunicodex2013a powerful family of attacks against large language models (LLMs) that optimize adversarial suffixes to circumvent safety alignment. Focusing on the widely used foundational GCG attack, we observe that suffixes vary in efficacy: some are markedly more universalunicodex2013generalizing to many unseen harmful instructionsunicodex2013than others. We first show that a shallow, critical mechanism drives GCG's effectiveness. This mechanism builds on the information flow from the adversarial suffix to the final chat template tokens before generation. Quantifying the dominance of this mechanism during generation, we find GCG irregularly and aggressively hijacks the contextualization process. Crucially, we tie hijacking to the universality phenomenon, with more universal suffixes being stronger hijackers. Subsequently, we show that these insights have practical implications: GCG's universality can be efficiently enhanced (up to ×5 in some cases) at no additional computational cost, and can also be surgically mitigated, at least halving the attack's success with minimal utility loss. We release our code and data at http://github.com/matanbt/interp-jailbreak.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 42 of its 57 references that are in the map. First posted on arXiv 15 Jun 2025.

Builds on

42 of 57 references.

Closest ancestors · 17

Same direction, newest first

  1. 2024What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks2 Nov
  2. 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation11 Oct
  3. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models13 Jun
  4. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
  5. 2024Investigating Adversarial Trigger Transfer in Large Language Models24 Apr
  6. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  7. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  9. 2024Fast Adversarial Attacks on Language Models In One GPU Minute23 Feb
  10. 2024Query-Based Adversarial Prompt Generation19 Feb
  11. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  12. 2024Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspective12 Jan
5 more
  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  3. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  5. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 25

  1. 2017Attention Is All You Needcited by 60,361
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  4. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  5. 2024Qwen2.5 Technical Reportcited by 4,942
  6. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  7. 2022FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awarenesscited by 3,673
  8. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,998
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  10. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  11. 2023A Survey on Evaluation of Large Language Modelscited by 1,242
  12. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
13 more
  1. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  3. 2023Dissecting Recall of Factual Associations in Auto-Regressive Language Modelscited by 528
  4. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  5. 2023Towards Best Practices of Activation Patching in Language Models: Metrics and Methodscited by 359
  6. 2020Causal Mediation Analysis for Interpreting Neural NLP: The Case of Gender Biascited by 191
  7. 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicitycited by 185
  8. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
  9. 2024A Primer on the Inner Workings of Transformer-based Language Modelscited by 85
  10. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Studycited by 55
  11. 2021Incorporating Residual and Normalization Layers into Analysis of Masked Language Modelscited by 51
  12. 2022How to Dissect a Muppet: The Structure of Transformer Embedding Spacescited by 20
  13. 2025Why Safeguarded Ships Run Aground? Aligned Large Language Models' Safety Mechanisms Tend to Be Anchored in The Template Regioncited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 10.

10 papers.

  1. 2026Boundary Point Jailbreaking of Black-Box LLMscited by 8
  2. 2026SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attackscited by 2
  3. 2026Steerability of Instrumental-Convergence Tendencies in LLMscited by 1
  4. 2026Beyond Suffixes: Token Position in GCG Adversarial Attacks on Large Language Modelscited by 0
  5. 2026Metaphor Is Not All Attention Needscited by 0
  6. 2026HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignmentcited by 0
  7. 2026xMIx: High-Performance Serving-Time Platform for Mechanistic Interpretability Appscited by 0
  8. 2026First Token Matters: Understanding Safety Collapse in Large Reasoning Modelscited by 0
  9. 2026Jumping the Line: Exploiting Length Predictions in LLM Schedulingcited by 0
  10. 2026Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoderscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models
  2. 2025Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?
  3. 2024Boosting Jailbreak Transferability for Large Language Models
  4. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models
  5. 2026TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking
  6. 2025Adversarial Suffix Filtering: a Defense Pipeline for LLMs
  7. 2024An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer
  8. 2026Compositional Jailbreaking: An Empirical Analysis of Mutator Chain Interactions in Aligned LLMs