Jul 2026· Proceedings of the Genetic and Evolutionary Computation Conference Companion· 0 citations· 18 references
TL;DR
TAPE-JB (Trait-Aligned Prompt Evolution for Jailbreaking LLMs), a genotype-guided evolutionary framework for adversarial prompt generation that searches over structured prompt traits while preserving the original harmful intention is introduced, highlighting the value of structured evolutionary search for systematic red-teaming of language models.
Abstract
Ensuring the safety of large language models (LLMs) requires rigorous evaluation against adversarial and jailbreaking attempts that can expose harmful behaviors. Malicious prompt generation, while inherently risky, is essential for systematically stress-testing model defenses and uncovering alignment vulnerabilities. Jailbreak attacks against large language models are often studied either through direct prompt rewriting or through search-based optimization over unconstrained prompt variants. We introduce TAPE-JB (Trait-Aligned Prompt Evolution for Jailbreaking LLMs), a genotype-guided evolutionary framework for adversarial prompt generation that searches over structured prompt traits while preserving the original harmful intention. Our method combines iterative prompt rewriting with an alignment-aware fitness function that jointly optimizes attack effectiveness, semantic faithfulness to the source intention, and realization of the intended prompt strategy. Across experiments, TAPE-JB consistently improves over simpler prompting baselines and outperforms CL-GSO on AdvBench, with a 14 percentage-point gain. Our results also show that the generated attacks retain cross-model transferability and that the proposed method remains effective in Polish (76% of attack success rate), demonstrating its applicability beyond the original English benchmark. These findings highlight the value of structured evolutionary search for systematic red-teaming of language models.
Large language models (LLMs) are vulnerable to jailbreak attacks that bypass safety alignment through carefully crafted prompts. Many existing defenses require access to model weights or internals, making them difficult to apply to black-box deployments. We propose AlcaTRAz (Anchored Tree-Rule defense Against jailbreaks), a prompt-level defense based on rule trees that operates exclusively on the input text and requires no modification or retraining of the target model. The method automatically learns a transferable transformation rule that inserts controlled character-level perturbations at selected positions, thereby disrupting structural regularities exploited by jailbreak attacks while largely preserving the model's utility on benign queries. We evaluate the proposed method across 33 open-weight models, 22 jailbreak attack types, and a benchmark of short, single-turn benign questions, comparing against three representative prompt-level baselines (Llama Guard, RA-LLM, Goal Prioritization). Among the compared defenses, AlcaTRAz achieves the best composite security and functionality score in 73.4 % of model-attack combinations and shifts the aggregate score from a modal value of 10 (maximal-severity response to the malicious request) in the undefended setting to a modal value of 2 (near-refusal) after defense, while keeping the mean benign score within 0.27 points of the undefended baseline (8.35 vs. 8.62 on a 0-10 scale). AlcaTRAz substantially reduces but does not eliminate jailbreak success: a high-severity tail remains, and we do not consider adaptive attackers, so we position it as one layer within a defense-in-depth strategy rather than a standalone guarantee.
J. Res, Petr Kaska, Martin Perešíni et al.· 0 citations
Recent jailbreak attacks demonstrate that large language models (LLMs) can be manipulated to generate harmful outputs through adversarial prompts even after robust alignment. However, prevailing methods typically focus on forcing a desired response at the output layer—a surface-level strategy that is brittle and often fails to bypass the more fundamental safety checks embedded within the model’s internal mechanisms. In contrast, we propose intermediate consistency greedy coordinate gradient (IC-GCG), an approach that extends the GCG framework to explicitly target the model’s internal alignment mechanism. Our method forces a harmful prompt’s hidden representations to mimic those of a semantically related benign counterpart within critical middle layers. By adapting a greedy coordinate optimization strategy to craft an adversarial suffix that minimizes this representational distance, IC-GCG creates “semantic camouflag” that bypasses the model’s internal safety judgments. Experiments on several aligned LLMs indicate that IC-GCG substantially outperforms state-of-the-art baselines, increasing the average attack success rate to 94.3% and proving particularly effective against strongly aligned models such as LLAMA2-7B-CHAT, where it boosts success by over 56 percentage points. Furthermore, the resulting suffixes display superior transferability to other models. Ablation studies confirm that this high efficacy critically depends on a strong semantic link between the harmful and benign prompt pair, empirically validating that the integrity of intermediate representations is a crucial vulnerability and highlighting the need for a new class of defenses that operate directly on the model’s internal states.
Zichu Ren, Donghai Zhu, Haibo Hong et al.· IEEE Internet of Things Jour...· 0 citations
This work proposes an explanation-aware safety framework that augments binary harmfulness detection with structured, human-interpretable explanations capturing severity, strategies, trigger spans, ratio-nales, and derived safety factors, and introduces a human–LLM hybrid annotation and canonicaliza-tion pipeline.
Sunghee Dong, Sungwon Yi, Kangmin Bae et al.· 0 citations
: Large language models are increasingly being deployed in safety-critical domains, yet remain vulnerable to jailbreak attacks that circumvent safety alignments. This systematic review synthesizes empirical jailbreak research published between 2024 and 2025, using a PRISMA-guided search protocol, followed by BERTopic-based topic modeling. The analysis identifies eight main jailbreak categories: optimization-based, ge-netic/evolutionary, iterative refinement, semantic/persuasion-based, decomposition, context/generation-level, visual/encoding and fuzzing attacks, and characterizes their effectiveness, efficiency, and transferability across open-source and proprietary models, including Llama-2/3, Vicuna, GPT-3.5/4, Claude, Gemini, and DeepSeek-V3. Results show that simple configuration and context-level attacks can match the near-perfect attack success rates of sophisticated white-box optimization methods on models such as Llama-2, while requiring far fewer queries and no parameter access, highlighting a gap between research focus and practical threat severity. The review further identifies five recurring vulnerability mechanisms: representation-level gaps, execution-priority manipulation, semantic fragmentation, gradient-space exploitation and persuasion susceptibility, and documents family-specific vulnerability patterns, with open-source Llama-based models consistently more exposed than safety-enhanced architectures such as Claude. Diverse methods, uneven focus on models and publication bias limit how broadly results apply. Nonetheless, the review reveals that weaknesses in safety alignment persist across successive LLM generations, urging that effective defenses must address all eight attack categories rather than isolated techniques.
Meda Račaitytė, Hélder Bastos, R. Ribeiro et al.· International Conference on...· 0 citations
A mechanistic analysis of the jailbreaking behavior in a large-scale, safety-aligned LLM, focusing on LLaMA-2-7B-chat-hf identifies computational circuits responsible for generating affirmative responses to jailbreak prompts and uncovers key attention heads and MLP pathways that mediate adversarial prompt exploitation.
Paria Mehrbod, Boris Knyazev, Guy Wolf et al.· 0 citations
This work proposes a novel jailbreak framework: YAE, which enhances the model's dependency on external information by constructing a RAG‐based knowledge base containing harmful Q&A content and leverages Guide MoE, a routing‐inspired prompting strategy, to guide the model toward alternative reasoning trajectories through expert‐role prompting and domain‐specific perturbations.
