Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents

Summary

Researchers study jailbreak attacks on LLM agents, comparing zeroth-order (function-value feedback), first-order (gradient-based), and combined optimization orderings. They propose a ZO-FO framework with Pair-aware optimization, which keeps multiple adversarial prefix candidates, refines their suffixes, and selects among the resulting prefix-suffix pairs. Experiments on malicious-instruction and malicious-environment benchmarks show hybrid optimization improves attack effectiveness over single-optimizer methods, and optimization order substantially affects performance.

Topics

• Prompt injection and jailbreaks

Related items

• InfoSafety Mid-Training: Internalizing LLM Safety as a Foundational CapabilitySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoConcerns in Benchmarking Jailbreaks: An Empirical Study of Attack Success RatesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoBeyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM JailbreaksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoBudgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online FeedbackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPeer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code SecuritySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)