mlsanityData to 14 Oct 2026

Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search

arXiv 2609.02172 ↗First posted 2 Sep 2026cs.CL cs.LGcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Optimization-based jailbreak attacks such as Greedy Coordinate Gradient (GCG) achieve strong effectiveness and transferability by optimizing adversarial suffixes on white-box source models. However, existing GCG-based methods rely on averaged adversarial loss and deep greedy search, which can over-emphasize easy-to-jailbreak behaviors and overlook promising regions of the suffix space. We propose BOSS, a plug-and-play framework that improves GCG-based jailbreak optimization through breadth-oriented suffix search. BOSS uses Tail-Focused Adversarial Loss (TFAL), standard source loss, and behavior coverage to select terminal suffixes, then explores multiple short trajectories and selectively continues promising suffixes. Experiments on public benchmarks show that BOSS improves attack success rates across multiple GCG-based methods while reducing optimization time.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 14 of its 23 references that are in the map. First posted on arXiv 2 Sep 2026.

Builds on

14 of 23 references.

Closest ancestors · 6

Same direction, newest first

  1. 2026SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks4 Jun
  2. 2025Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints25 Feb
  3. 2024Don't Say No: Jailbreaking LLM by Suppressing Refusal25 Apr
  4. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  5. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 8

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  5. 2015Non-stochastic Best Arm Identification and Hyperparameter Optimizationcited by 221
  6. 2018A System for Massively Parallel Hyperparameter Tuningcited by 202
  7. 2016Sequence-to-Sequence Learning as Beam-Search Optimizationcited by 127
  8. 2019A Generalized Framework for Population Based Trainingcited by 22

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models
  2. 2024Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models
  3. 2025Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?
  4. 2026TACS: Trajectory-Aware Candidate Selection for LLM Jailbreak Suffix Optimization
  5. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models
  6. 2024An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer
  7. 2026TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking
  8. 2024Boosting Jailbreak Attack with Momentum