mlsanityData to 7 Oct 2026

Beyond Suffixes: Token Position in GCG Adversarial Attacks on Large Language Models

arXiv 2602.03265 ↗First posted 3 Feb 2026cs.LGcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Large Language Models (LLMs) have seen widespread adoption across multiple domains, creating an urgent need for robust safety alignment mechanisms. However, robustness remains challenging due to jailbreak attacks that bypass alignment via adversarial prompts. In this work, we focus on the prevalent Greedy Coordinate Gradient (GCG) attack and identify a previously underexplored attack axis in jailbreak attacks typically framed as suffix-based: the placement of adversarial tokens within the prompt. Using GCG as a case study, we show that both optimizing attacks to generate prefixes instead of suffixes and varying adversarial token position during evaluation substantially influence attack success rates. Our findings highlight a critical blind spot in current safety evaluations and underline the need to account for the position of adversarial tokens in the adversarial robustness evaluation of LLMs.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 16 of its 22 references that are in the map. First posted on arXiv 3 Feb 2026.

Builds on

16 of 22 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 14

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  6. 2024DeepSeek LLM: Scaling Open-Source Language Models with Longtermismcited by 621
  7. 2023Sentiment Analysis in the Era of Large Language Models: A Reality Checkcited by 262
  8. 2023Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Modelscited by 130
  9. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 98
  10. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 87
  11. 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulationcited by 31
  12. 2023Will releasing the weights of future large language models grant widespread access to pandemic agents?cited by 25
2 more
  1. 2025Universal Jailbreak Suffixes Are Strong Attention Hijackerscited by 9
  2. 2025Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?cited by 6

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs
  2. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models
  3. 2024Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models
  4. 2024Advancing Adversarial Suffix Transfer Learning on Aligned Large Language Models
  5. 2024Adversarial Attacks on Large Language Models Using Regularized Relaxation
  6. 2025Universal and Transferable Adversarial Attack on Large Language Models Using Exponentiated Gradient Descent
  7. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  8. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models