mlsanityData to 14 Oct 2026

All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attacks

arXiv 2606.03647 ↗First posted 2 Jun 2026cs.CR cs.AI cs.LGcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Accurately evaluating adversarial robustness is a longstanding challenge. A flawed attack design can inflate robustness estimates, making deployment risk assessment and defense comparison unreliable. Historically, standardized attacks such as AutoAttack have largely resolved this for image classifiers, providing a reliable evaluation baseline for systematic comparison across defenses. However, no equivalent exists for LLM jailbreak evaluation yet, where designing such an attack is considerably more difficult. A reliable attack must, among other things, be black-box compatible, applicable to arbitrary defense pipelines, and efficient, which no existing method jointly satisfies. We introduce Indirect Harmfulness Optimization (IHO), a masked diffusion language model attacker trained via iterative preference optimization against a harmfulness judge, requiring only black-box access to the target. The same method can be used without modification as a strong adapting attack on individual behaviors, or as an efficient amortized policy that transfers to held-out behaviors and unseen target models without fine-tuning. Even against layered defenses, such as GLM 5.3-flash served through a black-box API deploying an auxiliary detector, IHO improves attack success considerably over state-of-the-art approaches, without any defense-specific adaptation. Our results position IHO as a practical step toward the kind of standardized jailbreak evaluation that has improved reliability in the past. Code and models are available on GitHub and Hugging Face.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 35 of its 41 references that are in the map. First posted on arXiv 2 Jun 2026.

Builds on

35 of 41 references.

Closest ancestors · 21

Same direction, newest first

  1. 2025AdversariaLLM: A Unified and Modular Toolbox for LLM Robustness Research6 Nov
  2. 2025Diffusion LLMs are Natural Adversaries for any LLM31 Oct
  3. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections10 Oct
  4. 2025One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs23 May
  5. 2025REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective24 Feb
  6. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming31 Jan
  7. 2024Best-of-N Jailbreaking4 Dec
  8. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  9. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs22 Jul
  10. 2024Efficient Adversarial Training in LLMs with Continuous Attacks24 May
  11. 2024Investigating Adversarial Trigger Transfer in Large Language Models24 Apr
  12. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs21 Apr
9 more
  1. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  2. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  3. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  4. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  5. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  6. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  8. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 14

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  5. 2025Large Language Diffusion Modelscited by 912
  6. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  7. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  8. 2019On Evaluating Adversarial Robustnesscited by 447
  9. 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 199
  10. 2025PolyGuard: A Multilingual Safety Moderation Tool for 17 Languagescited by 59
  11. 2025Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learningcited by 27
  12. 2026A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustnesscited by 20
2 more
  1. 2024Toward Optimal LLM Alignments Using Two-Player Gamescited by 13
  2. 2025Sampling-aware Adversarial Attacks Against Large Language Modelscited by 9

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Black-box Optimization of LLM Outputs by Asking for Directions
  2. 2026Automated jailbreak attack targeting multiple defense strategies
  3. 2025Fast Proxies for LLM Robustness Evaluation
  4. 2026SoK: Robustness in Large Language Models against Jailbreak Attacks
  5. 2025Efficient Safety Retrofitting Against Jailbreaking for LLMs
  6. 2026Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks
  7. 2025ShieldLearner: A New Paradigm for Jailbreak Attack Defense in LLMs
  8. 2025LLM Robustness Leaderboard v1 --Technical report