ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack

Summary

ECHO is an optimization-based jailbreak attack that replaces the usual token-level compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor. It pairs this with five word-level perturbation operators and Keyword-Anchored Beam Search under a strict black-box threat model. Across five open-weight victims on AdvBench, it reaches up to 0.898 StrongREJECT mean score and 89.23% HarmBench success.

Topics

• Prompt injection and jailbreaks

Related items

• MediumOpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish TasksSimilar attack · SecurityWeek
• InfoStealthy Poisoning Attacks via Reused KV Cache of ReasoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowTypeSafe’s Jev ‘even more susceptible to attack’ than LLMs, says security vendorSimilar attack · CSO Online
• InfoRefusal Is Not Robustness: Measuring Harmful Reachability in Autoregressive Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowJev as a judge: How counterfeit policy steers JevSimilar attack · Datadog Security Labs