mlsanityData to 13 Oct 2026

Beyond Suffixes: Token Position in GCG Adversarial Attacks on Large Language Models

arXiv 2602.03265 ↗First posted 3 Feb 2026cs.LGcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Large Language Models (LLMs) have seen widespread adoption across multiple domains, creating an urgent need for robust safety alignment mechanisms. However, robustness remains challenging due to jailbreak attacks that bypass alignment via adversarial prompts. In this work, we focus on the prevalent Greedy Coordinate Gradient (GCG) attack and identify a previously underexplored attack axis in jailbreak attacks typically framed as suffix-based: the placement of adversarial tokens within the prompt. Using GCG as a case study, we show that both optimizing attacks to generate prefixes instead of suffixes and varying adversarial token position during evaluation substantially influence attack success rates. Our findings highlight a critical blind spot in current safety evaluations and underline the need to account for the position of adversarial tokens in the adversarial robustness evaluation of LLMs.

Key facts. No citing papers in the map yet (data through 13 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 16 of its 22 references that are in the map. First posted on arXiv 3 Feb 2026.

Builds on

16 of 22 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 14

  1. 2023GPT-4 Technical Reportcited by 18,278
  2. 2022Training language models to follow instructions with human feedbackcited by 15,856
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,986
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,637
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,009
  6. 2024DeepSeek LLM: Scaling Open-Source Language Models with Longtermismcited by 634
  7. 2023Sentiment Analysis in the Era of Large Language Models: A Reality Checkcited by 264
  8. 2023Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Modelscited by 134
  9. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 107
  10. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 95
  11. 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulationcited by 33
  12. 2023Will releasing the weights of future large language models grant widespread access to pandemic agents?cited by 26
2 more
  1. 2025Universal Jailbreak Suffixes Are Strong Attention Hijackerscited by 10
  2. 2025Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?cited by 6

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models
  2. 2025The Resurgence of GCG Adversarial Attacks on Large Language Models
  3. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs
  4. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models
  5. 2024AmpleGCG-Plus: A Strong Generative Model of Adversarial Suffixes to Jailbreak LLMs with Higher Success Rates in Fewer Attempts
  6. 2026SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks
  7. 2024Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models
  8. 2024Advancing Adversarial Suffix Transfer Learning on Aligned Large Language Models