Automated Jailbreak Generation

The loop treats that thread as solved and stops rewriting, so the search ends early. The mislabelled refusal is written into the finding list as a discovered attack, and a human triager has to read the transcript to throw it out. Your reported success count is inflated by every such label.

Any search that only needs to send text and read replies still runs: template and mutation pools, and attacker-model loops that rewrite a prompt after each refusal. Gradient-guided suffix optimisation is ruled out — it needs backward passes through the model's weights. Without weights you can only optimise against a local surrogate and hope it transfers.

The raw count measures how often the search repeated itself, not how much it found. Thousands of near-identical rewrites are one weakness discovered many times. The signal that matters is distinct successful templates: when that stops rising while queries keep being spent, the remaining allowance is buying duplicates.

The seed corpus is the set of prompt templates the tool starts from, usually ones that already made the model comply. Mutation edits them by rewording, filling slots differently, or splicing two together to make many near variants. It needs only query access: send a prompt, read the reply. No weights, no gradients.

The fitness function scores each candidate prompt's result and decides which prompts survive to be mutated and crossed over. The search is indifferent to meaning: it maximises whatever number you hand it. So the operator's choice of that number defines what the run can possibly discover.

Computing that gradient needs a backward pass through the model's weights. A hosted endpoint returns generated text, not derivatives with respect to your input tokens. With no weights loaded on hardware you control, there is nothing to differentiate, so the search never starts. Against that endpoint you are limited to query-driven attacks.

Because the check only reads the reply's first few tokens. A model can open with the agreed phrase and then refuse, stall, or produce useless text. The search optimises exactly that prefix, so it overfits it. Before recording a hit, read or grade the whole continuation.

Transfer means the string you optimised on the local model still produces the disallowed behaviour on the hosted endpoint, with no re-optimisation. Failure there is uninformative because you get no gradients and no internals back, only the reply text. On the local model a failure still shows you the loss and lets you keep searching.

With the width cap you send about w times b candidates per level, so roughly w times b times d prompts per seed behaviour, linear in depth. Remove the cap and every child branches again, so the count grows like b to the power of d. The cap is what keeps a deep search affordable.

Run a pilot with a generous cap and record, for every thread that succeeded, the turn on which it first succeeded. Most hits land early and the tail is thin. Put the cap where new hits stop accruing, then spend the freed calls on more restarts and more seed goals instead of deeper threads.

Toward false success: fictional or roleplay wrappers, agreeable openings that then refuse, restatements of the request, and vague non-actionable text. Toward missed success: harmful content buried mid-answer, output in another language, code or encoded output. Catch them by hand-labelling a sample of both hits and non-hits.

You need the weights locally, the matching tokenizer, and enough GPU memory to run forward and backward passes, plus a target string whose likelihood the search maximises. Its cost is GPU-hours, not API calls: many gradient steps and batched candidate evaluations per suffix, with nothing billed per request.

Group the successful prompts and count groups per thousand queries spent. Surface-text similarity misleads both ways: a search mutates wording heavily while keeping one mechanism, splitting one template into many groups, and two unrelated mechanisms that share boilerplate collapse into one. Cluster on the mechanism and on what the target actually did.

It counts variants, not distinct weaknesses. Those 400 are near-copies of three seeds, so write it as three template families that still reproduce under rewording, with a reproduction rate each. The denominator is variants you generated, not the model's behaviours or its attack surface, so it supports no breadth claim at all.

Because not refusing is not the same as complying. The cheapest way to avoid refusal wording is to stop asking for anything harmful, so the search drifts toward fluent, harmless prompts that get chatty answers. The population is full of false successes carrying no payload.

You need the specific checkpoint's weights on a machine you control, its tokenizer and chat template, permission to hold those weights, and a GPU with room for the model plus backward-pass activations. The gradients belong to that one weight tensor, so nothing carries over: each new model means fresh weights, fresh setup and fresh GPU hours.

Gradients need a differentiable number. Cross-entropy on a fixed target completion gives one; a judge's yes or no is a discrete label from another model with no usable gradient. The string you pick sets the difficulty: a short generic opener is easy but weak evidence, a long specific one is slower and rarer.

Pick a local model as close as you can guess to the hidden one: similar tokenizer, similar chat formatting, similar safety tuning. The string is optimised for those exact tokens and that exact refusal behaviour. Optimising against several local models at once forces the string onto behaviour they share instead of one model's quirks, which usually survives the jump better.

The search is optimising the judge, not the target. Any judge has blind spots, and selection pressure finds them: replies that look harmful to the rater but are not. Fix it by verifying top candidates with a different checker that never drove selection, and by holding out judged examples to measure the rater.

The search optimises token probabilities, not readability, so the winning string is statistically bizarre — exactly what a perplexity score measures. Scoring it needs one pass through a tiny model, far cheaper than the search that produced it. The cost is false positives on legitimately odd input and a threshold that must be tuned per traffic mix.

The endpoint changed under you: a new model build, an altered system prompt, or a filter added in front or behind it. Your string did not decay. The entry should have stamped the date, the endpoint and any build identifier returned, decoding settings, the number of attempts, and how a hit was judged. Without those, nothing is attributable.

It stops the attacker model wandering into prompts that no longer ask for the behaviour you are testing, so the queries you pay for buy relevant attempts. The cost is false pruning: an oblique, apparently unrelated framing is often exactly what slips past a filter, and a strict on-topic check kills it one turn early.

Because the scorer is not just measuring the run, it is steering it. A false success stops a thread that had not actually broken through; a false refusal keeps a solved thread spending budget or prunes a promising line. Fix it by separating the loop's stop signal from the report's gate.

Three calls per iteration: the attacker model that writes the next prompt, the system under test that answers it, and the judge that rates the answer. Totals scale as branches times depth times three, so widening the search multiplies spend on all three meters, not only the target's.

Because almost every early candidate scores 0, so selection has nothing to rank and the search becomes random. Operators use a graded signal: partial credit for a reply that engages, moves toward the requested content, or omits a refusal, so gradual improvement is visible and can be selected for.

Comparable capability does not mean comparable internals. Different tokenizers re-split your string, different safety tuning gives a different refusal to suppress, hidden system prompts differ, and one endpoint may be a pipeline with classifiers around the model. You separate them from the outside by comparing the shape of the failures: wording, variation, latency, and whether any output streamed at all.

The allowance is global and the search walks seeds one at a time, so early seeds spend everything. Confirm it by counting queries per seed and per level. Fix it by dividing the allowance into a per-seed cap, capping frontier width, and stopping a seed early once it hits or clearly stalls.

Depth buys refinement of one framing; restarts buy independent draws at the same goal. Since most hits land in early turns, past the knee of the turn-to-first-hit curve a restart returns more hits per call than another turn. Set the cap at that knee and put the remaining budget into restarts.

Flat ratings, near-duplicate candidates from the attacker, and an unchanging refusal from the target together say the thread has converged on nothing. Stop it early, keep the transcript, and return the remaining turns to the pool for a fresh restart from a different seed framing rather than more rewrites of a losing line.