Technical Summary: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Models

Problem Statement

The rapid proliferation of Large Language Models (LLMs) has intensified security concerns regarding "jailbreak" attacks, where adversarial inputs are crafted to bypass alignment safeguards and elicit unsafe content. While proprietary models like GPT-4 have been extensively evaluated, the robustness of emerging open-source systems, specifically the DeepSeek family (e.g., DeepSeek-R1), remains insufficiently examined. Despite their growing adoption in real-world applications, there is a critical lack of comparative analysis regarding how open-source models like DeepSeek handle adversarial inputs compared to established closed-source counterparts like GPT-3.5 and GPT-4. This gap is significant because open-source models are rapidly gaining traction, yet their safety alignment mechanisms and generalization capabilities under attack are not well understood.

Methodology

The authors conducted a large-scale, systematic evaluation of jailbreak resilience using the HarmBench benchmark. The study compared the DeepSeek model family (distilled variants ranging from 1.5B to 32B parameters) against GPT-series models (GPT-3.5-Turbo and GPT-4 variants, including 0613 and 1106 releases).

Evaluation Framework

• Dataset: The study utilized 510 harmful behaviors from HarmBench, organized into four categories: standard, copyright, contextual, and multimodal.
• Attack Taxonomy: The evaluation covered seven representative attack strategies across two threat models:
  • Black-box Attacks: Context-based (e.g., HumanJailbreak), Prompt-rewriting (e.g., GCG-T, ArtPrompt), and LLM-based (e.g., PAIR, TAP-T, PAP, ZeroShot).
  • White-box Attacks (DeepSeek only): Gradient-based (GCG, AutoDan, TAP) and Logit-based (H-CoT).
• Metrics: The primary metric was the Attack Success Rate (ASR), calculated using classifier-based evaluation protocols (Llama-2-13B-Chat for non-copyright behaviors and hashing-based classifiers for copyright behaviors) to determine if a model output constituted a successful jailbreak.
• Baseline: A Direct Request (DR) setting served as the baseline for comparison to measure the relative uplift in vulnerability caused by specific attacks.

Key Contributions

1. First Comprehensive DeepSeek Evaluation: This work presents the first systematic investigation of jailbreak robustness in the DeepSeek model family, benchmarking it directly against GPT-series models under standardized conditions.
2. Fine-Grained Comparative Analysis: The authors employed functional and semantic categorizations to assess alignment behavior, moving beyond aggregate scores to analyze performance across specific behavioral domains (e.g., misinformation, cybercrime, chemical safety).
3. Scaling vs. Robustness Analysis: The study investigates how model scale influences vulnerability, comparing the 1.5B through 32B DeepSeek variants to identify trends in safety degradation as parameter counts increase.
4. Attack-Specific Resilience Profiling: The paper uncovers distinct patterns in how different models resist specific attack vectors, revealing that resilience is not uniform across all adversarial strategies.

Key Results

General Performance and Scaling

• GPT Superiority: GPT-4 and GPT-4 Turbo demonstrated the strongest and most consistent robustness across all categories, exhibiting significantly lower ASRs than DeepSeek models.
• DeepSeek Scaling Vulnerability: Contrary to the assumption that larger models are inherently safer, DeepSeek models showed increasing susceptibility as scale grew. For instance, under the GCG attack, ASR for DeepSeek rose from 33.44% (1.5B) to 55.31% (32B). Similarly, H-CoT attacks saw a near-monotonic increase in success rates with model size.
• Attack Vector Sensitivity:
  • DeepSeek: Showed selective resistance to optimization-driven attacks (like TAP-T) but was significantly more vulnerable to prompt-based and human-engineered exploits (e.g., ZeroShot attacks resulted in ~77% ASR for DeepSeek vs. ~19% for GPT-4).
  • GPT: While generally robust, GPT models were found to be sensitive to fine-grained token perturbations (TAP-T) and linguistically disguised prompts, though they maintained lower overall failure rates.

Domain-Specific Findings

• Standard and Contextual Behaviors: DeepSeek models exhibited higher vulnerability in generating unsafe outputs for standard and contextual harmful behaviors compared to GPT.
• Copyright: An interesting reversal was observed in the copyright domain, where GPT-4 models showed higher violation rates than DeepSeek, which achieved near-zero ASR for larger variants.
• High-Risk Domains: In domains such as misinformation, cybercrime, and illegal activities, DeepSeek exhibited substantially higher ASRs (e.g., 0.6422 for misinformation vs. ~0.2 for GPT), suggesting weaker safety alignment in socially sensitive topics. Conversely, in chemical and biological domains, DeepSeek variants successfully prevented jailbreaks where GPT models showed some vulnerability.

Behavioral Consistency

Fine-grained analysis revealed that DeepSeek often fails to apply safety constraints consistently across adversarial prompts, leading to uneven refusal behaviors. In contrast, GPT models demonstrated more consistent refusal mechanisms across diverse inputs.

Significance and Claims

The paper claims that its findings highlight an inherent trade-off between model efficiency/capacity and alignment generalization. The authors argue that:

1. Scaling Alone is Insufficient: Increasing model parameters does not guarantee improved safety; in fact, without proportional scaling of alignment mechanisms, larger models may become more vulnerable to specific adversarial strategies.
2. Alignment Maturity Matters: The superior performance of GPT models is attributed to stronger safety optimization and Reinforcement Learning from Human Feedback (RLHF), whereas open-source models like DeepSeek may rely on less extensive safety reinforcement, leaving them susceptible to sophisticated prompt engineering.
3. Need for Targeted Tuning: The results underscore the necessity for targeted safety tuning and robust alignment strategies to ensure the secure deployment of open-source LLMs. The authors suggest that future defenses must move toward adaptive, scalable alignment frameworks capable of securing both proprietary and open-source systems against evolving jailbreak techniques.

The study concludes that while DeepSeek offers strong reasoning capabilities, its safety alignment requires further refinement to match the consistency and robustness of leading proprietary models, particularly against human-engineered and prompt-based adversarial attacks.