A Gradient-Calibrated Adversarial Prompt Optimization Framework for Large Language Model Safety Evaluation
Large language models (LLMs) may still produce unsafe responses under optimized adversarial prompts, even after safety alignment. Existing gradient-based jailbreak evaluation methods usually use raw gradient signals for discrete prompt search, but raw gradients may be unstable in both magnitude and direction. This paper proposes a gradient-calibrated adversarial prompt optimization framework for LLM safety evaluation. The framework adopts REINFORCE-style randomized discrete prompt optimization as the parent objective and inserts a unified calibration interface before gradient-derived token-search signals are used. We instantiate this interface with two complementary primitives: LSGM for layer-wise magnitude calibration and LiLA for representation-space directional calibration. Experiments on HarmBench show that joint calibration improves attack success rate on multiple open-source safety-aligned models. Ablation results further suggest that the two primitives are more stable when used jointly than when used alone. The framework provides a compact white-box diagnostic tool for analyzing gradient quality in discrete adversarial prompt optimization, while transfer and defense results reveal clear limitations in generalizability and practical robustness.