mlsanityData to 14 Oct 2026

VERA: Variational Inference Framework for Jailbreaking Large Language Models

arXiv 2506.22666 ↗First posted 27 Jun 2025cs.CR cs.CL cs.LGcited by 4

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

The rise of API-only access to state-of-the-art LLMs highlights the need for effective black-box jailbreak methods to identify model vulnerabilities in real-world settings. Without a principled objective for gradient-based optimization, most existing approaches rely on genetic algorithms, which are limited by their initialization and dependence on manually curated prompt pools. Furthermore, these methods require individual optimization for each prompt, failing to provide a comprehensive characterization of model vulnerabilities. To address this gap, we introduce VERA: Variational infErence fRamework for jAilbreaking. VERA casts black-box jailbreak prompting as a variational inference problem, training a small attacker LLM to approximate the target LLM's posterior over adversarial prompts. Once trained, the attacker can generate diverse, fluent jailbreak prompts for a target query without re-optimization. Experimental results show that VERA achieves strong performance across a range of target LLMs, highlighting the value of probabilistic inference for adversarial prompt generation.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 30 of its 40 references that are in the map. First posted on arXiv 27 Jun 2025.

Builds on

30 of 40 references.

Closest ancestors · 19

Same direction, newest first

  1. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  2. 2024RL-JACK: Reinforcement Learning-powered Black-box Jailbreaking Attack against LLMs13 Jun
  3. 2024When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search13 Jun
  4. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
  5. 2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs21 Feb
  6. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  7. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  9. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation6 Nov
  10. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models23 Oct
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  12. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
7 more
  1. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  2. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  3. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  4. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Models4 Sep
  5. 2023Detecting Language Model Attacks with Perplexity27 Aug
  6. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  7. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 11

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  5. 2022Red Teaming Language Models with Language Modelscited by 1,026
  6. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  7. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  8. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 336
  9. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  10. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 234
  11. 2023Orca 2: Teaching Small Language Models How to Reasoncited by 159

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 3.

4 papers.

  1. 2026Systematic Scaling Analysis of Jailbreak Attacks in Large Language Modelscited by 2
  2. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Modelscited by 1
  3. 2026Directional Embedding Smoothing for Robust Vision Language Modelscited by 0
  4. 2026LLM Alignment--Utility Asymmetry under Semantic-Preserving Transformationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
  2. 2025Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMs
  3. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily
  4. 2026Adversarial Reframing: A Framework for Targeted Generation in Language Models
  5. 2025ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models
  6. 2026LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Models
  7. 2025LatentBreak: Jailbreaking Large Language Models through Latent Space Feedback
  8. 2024GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs