ToxSearch: Evolving Prompts for Toxicity Search in Large Language Models
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
Large Language Models remain vulnerable to adversarial prompts that elicit toxic content even after safety alignment. We present ToxSearch, a black-box evolutionary framework that tests model safety by evolving prompts in a synchronous steady-state loop. The system employs a diverse set of operators, including lexical substitutions, negation, back-translation, paraphrasing, and two semantic crossover operators, while a moderation oracle provides fitness guidance. Operator-level analysis shows heterogeneous behavior: lexical substitutions offer the best yield-variance trade-off, semantic-similarity crossover acts as a precise low-throughput inserter, and global rewrites exhibit high variance with elevated refusal costs. Using elite prompts evolved on LLaMA 3.1 8B, we observe practically meaningful but attenuated cross-model transfer, with toxicity roughly halving on most targets, smaller LLaMA 3.2 variants showing the strongest resistance, and some cross-architecture models retaining higher toxicity. These results suggest that small, controllable perturbations are effective vehicles for systematic red-teaming and that defenses should anticipate cross-model reuse of adversarial prompts rather than focusing only on single-model hardening.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 16 of its 22 references that are in the map. First posted on arXiv 16 Nov 2025.
Builds on
16 of 22 references.
Closest ancestors · 3
Same direction, newest first
- 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmetic19 Feb
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
Other references · 13
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
- 2022Red Teaming Language Models with Language Modelscited by 983
- 2023Promptbreeder: Self-Referential Self-Improvement Via Prompt Evolutioncited by 521
- 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
- 2018Generating Natural Language Adversarial Examplescited by 422
- 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
- 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 213
- 2023EvoPrompt: Connecting LLMs with Evolutionary Algorithms Yields Powerful Prompt Optimizerscited by 189
- 2024Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Promptscited by 189
- 2023Language Model Crossover: Variation through Few-Shot Promptingcited by 119
- 2023InstOptima: Evolutionary Multi-objective Instruction Optimization via Large Language Model-based Instruction Operatorscited by 16
- 2023No Offense Taken: Eliciting Offensiveness from Language Modelscited by 3
1 more
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Optimus: A Robust Defense Framework for Mitigating Toxicity while Fine-Tuning Conversational AI
- 2024The Dark Side of Human Feedback: Poisoning Large Language Models via User Inputs
- 2025Exploring the Secondary Risks of Large Language Models
- 2025Probing AI Safety with Source Code
- 2026Exposing Long-Tail Safety Failures in Large Language Models through Efficient Diverse Response Sampling
- 2025Circumventing Safety Alignment in Large Language Models Through Embedding Space Toxicity Attenuation
- 2026Where Does Toxicity Live? Mechanistic Localization and Targeted Suppression in Language Models
- 2026EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents