Super Suffixes: Bypassing Text Generation Alignment and Guard Models Simultaneously
Not on the map. Why?
Abstract (arXiv)
The rapid deployment of Large Language Models (LLMs) has created an urgent need for enhanced security and privacy measures in Machine Learning (ML). LLMs are increasingly being used to process untrusted text inputs and even generate executable code, often while having access to sensitive system controls. To address these security concerns, several companies have introduced guard models, which are smaller, specialized models designed to protect text generation models from adversarial or malicious inputs. In this work, we advance the study of adversarial inputs by introducing Super Suffixes, suffixes capable of overriding multiple alignment objectives across various models with different tokenization schemes. We demonstrate their effectiveness, along with our joint optimization technique, by successfully bypassing the protection mechanisms of Llama Prompt Guard 2 on five different text generation models for malicious text and code generation. To the best of our knowledge, this is the first work to reveal that Llama Prompt Guard 2 can be compromised through joint optimization. Additionally, by analyzing the changing similarity of a model's internal state to specific concept directions during token sequence processing, we propose an effective and lightweight method to detect Super Suffix attacks. We show that the cosine similarity between the residual stream and certain concept directions serves as a distinctive fingerprint of model intent. Our proposed countermeasure, DeltaGuard, significantly improves the detection of malicious prompts generated through Super Suffixes. It increases the non-benign classification rate to nearly 100%, making DeltaGuard a valuable addition to the guard model stack and enhancing robustness against adversarial prompt attacks.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 34 of its 55 references that are in the map. First posted on arXiv 12 Dec 2025.
Builds on
34 of 55 references.
References · 34
- 2023GPT-4 Technical Reportcited by 18,396
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
- 2017Deep reinforcement learning from human preferencescited by 3,912
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Qwen Technical Reportcited by 3,344
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2020Learning to summarize from human feedbackcited by 2,588
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
22 more
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2022Toy Models of Superpositioncited by 971
- 2024Phi-4 Technical Reportcited by 711
- 2022Improving alignment of dialogue agents via targeted human judgementscited by 531
- 2019Quantifying the Carbon Emissions of Machine Learningcited by 521
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
- 2023Detecting Language Model Attacks with Perplexitycited by 431
- 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
- 2023Emergent Linear Representations in World Models of Self-Supervised Sequence Modelscited by 319
- 2023Are aligned neural networks adversarially aligned?cited by 315
- 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 191
- 2018The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigationcited by 165
- 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 111
- 2023From CLIP to DINO: Visual Encoders Shout in Multi-modal Large Language Modelscited by 98
- 2024GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysiscited by 96
- 2025JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulationcited by 54
- 2023Will releasing the weights of future large language models grant widespread access to pandemic agents?cited by 26
- 2025Using Mechanistic Interpretability to Craft Adversarial Attacks against Large Language Modelscited by 10
- 2025Adversarial Prompt Evaluation: Systematic Benchmarking of Guardrails Against Prompt Input Attacks on LLMscited by 9
- 2025Bypassing Prompt Guards in Production with Controlled-Release Promptingcited by 7
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2025Adversarial Suffix Filtering: a Defense Pipeline for LLMs
- 2024ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddings
- 2025Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models
- 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs
- 2024Towards Universal and Black-Box Query-Response Only Attack on LLMs with QROA
- 2025A Survey on Model Extraction Attacks and Defenses for Large Language Models
- 2024AmpleGCG-Plus: A Strong Generative Model of Adversarial Suffixes to Jailbreak LLMs with Higher Success Rates in Fewer Attempts
- 2024Jailbreaking Large Language Models Through Alignment Vulnerabilities in Out-of-Distribution Settings