Technical Summary: NonTextual Target Attack (NTA)

1. Problem Definition

Existing gradient-based jailbreak attacks on Large Language Models (LLMs) suffer from fundamental limitations regarding their optimization objectives. Current state-of-the-art methods (e.g., GCG, COLD-Attack, AdvPrefix) rely on predefined textual targets, typically forcing the model to output a specific affirmative prefix (e.g., "Sure, here is...").

This approach introduces two critical issues:

1. Over-constrained Search Space: By restricting the objective to a fixed string, these methods ignore a vast portion of the unsafe output space. If a target LLM's natural response patterns do not align with the predefined prefix (e.g., Llama-3 often starts with "Here" rather than "Sure"), the optimization process struggles to converge, leading to low attack success rates (ASR) even after many iterations.
2. Inefficiency: The large gap between the original model output and the rigid target prefix requires numerous optimization iterations to bridge, resulting in high computational costs and slow convergence.

The core problem is that a successful jailbreak is defined by the generation of unsafe or policy-violating content, not by the adherence to a specific lexical template. However, directly optimizing for "unsafety" is challenging because safety assessment is typically non-differentiable and occurs only after full text decoding.

2. Methodology: NonTextual Target Attack (NTA)

The authors propose NonTextual Target Attack (NTA), the first gradient-based attack that optimizes a non-textual constrained objective to maximize the probability of an unsafe response without enforcing specific response patterns.

Core Objective

The attack aims to maximize the unsafe probability $S(L(p))$ of the target LLM's response $L(p)$ given an adversarial prompt $p$, where $p$ is a variant of the original prompt $p_0$ within a feasible neighborhood $V(p_0)$:
$$\max_{p} S(L(p)), \quad \text{s.t. } p \in V(p_0)$$
Here, $S(\cdot)$ is a scoring model (e.g., a safety classifier or judge model) that estimates the likelihood of a response being unsafe.

Decomposition Strategy

Since $S(L(p))$ is non-differentiable with respect to the discrete prompt $p$, NTA decomposes the problem into two alternating, differentiable sub-objectives:

1. Response Optimization (Finding the Target):
   The method first searches for an optimal "harmful response" representation $r$ in the continuous logit space of the scoring model $S$. This is formulated as maximizing the unsafe score while maintaining semantic relevance to the original prompt.
   $$\min_{z^J_r} \mathcal{L}_{unsafe}(z^J_r) + \lambda \mathcal{L}_{sem}(z^J_{L(p)}, z^J_r)$$
   Where $\mathcal{L}_{unsafe}$ minimizes the negative log-likelihood of the response being safe, and $\mathcal{L}_{sem}$ penalizes semantic deviation from the current model output to ensure the target remains reachable.

2. Prompt Optimization (Inducing the Target):
   Once an optimal response representation $r$ is identified, the method searches for an adversarial suffix $\delta$ that forces the target LLM to generate a response matching $r$. This is achieved by minimizing the Mean Squared Error (MSE) between the target LLM's output logits and the optimized response logits.
   $$\delta^* = \arg \min_{\delta} \text{MSE}(z^L_{L(p_0 \oplus \delta)}, z^L_r)$$

Key Technical Components

• Vocabulary Projection Matrix: To bridge the gap between the scoring model (Judge) and the target LLM, which may use different tokenizers, NTA constructs a projection matrix $W$. This maps adversarial increments from the scoring model's vocabulary space to the target LLM's vocabulary space, handling token splitting and merging (e.g., mapping a single token in the judge to multiple sub-tokens in the target).
• Iterative Alternating Optimization: The algorithm alternates between optimizing the response representation in the scoring model's space and updating the adversarial suffix in the target LLM's space.
• Theoretical Validation: The authors provide a proposition proving that under continuous relaxation (treating tokens as probability vectors), the sequential solution to the sub-objectives approximates the optimal solution to the original non-differentiable objective.

3. Key Contributions

• Novel Objective: NTA is the first gradient-based attack to remove the constraint of fixed textual targets, instead optimizing directly for the probability of unsafe behavior.
• Expanded Search Space: By decoupling the attack from specific prefixes, NTA explores a significantly broader and more diverse space of harmful responses, avoiding the "local optima" traps of fixed-target methods.
• Efficiency: The decomposition into differentiable sub-objectives allows for rapid convergence, achieving high success rates with significantly fewer iterations than existing methods.
• Robustness: The method demonstrates strong transferability across different model architectures and resilience against various defense mechanisms (e.g., perplexity filtering, paraphrasing).

4. Experimental Results

The authors evaluated NTA on five safety-aligned open-source LLMs (Llama3-8B, Qwen3-8B, Mistral-7B, Vicuna-7B, DeepSeek-7B) and three advanced closed-source models (Llama3-70B, DeepSeek-R1-671B, Grok-3) using the AdvBench and HarmBench datasets.

• Attack Success Rate (ASR): NTA achieved an average ASR of 96.8% on AdvBench and 90.8% on HarmBench within just 100 optimization iterations.
• Comparison with SOTA: NTA outperformed the best existing gradient-based baselines (e.g., COLD-Attack, AdvPrompter) by over 40% in ASR. For instance, on Llama3-8B-it, NTA achieved 95% ASR-G compared to 47% for the best baseline (AdvPrompter).
• Convergence Speed: NTA reached an average ASR of 66.2% within the first 25 iterations, demonstrating rapid convergence compared to baselines that often stagnate or collapse into degenerate sequences.
• Response Diversity: Unlike fixed-target attacks that produce repetitive, stereotyped outputs, NTA generated semantically diverse harmful responses, as evidenced by higher Distinct N-grams Scores (DNS) and lower Self-BLEU scores.
• Defense Robustness: NTA maintained high ASR (e.g., 97% under Perplexity defense) against standard defense mechanisms where other methods failed completely (e.g., GCG dropped to 5%).
• Transferability: Prompts optimized on smaller white-box models successfully transferred to larger, advanced models (e.g., 35% ASR on Llama3-70B), outperforming other transfer methods.

5. Significance and Claims

The paper claims that NTA represents a paradigm shift in gradient-based jailbreaking by addressing the fundamental mismatch between optimization objectives and the actual goal of an attack (generating unsafe content vs. matching a string).

• Efficiency: The authors highlight that NTA achieves superior results with a fraction of the computational budget required by existing methods, making it a more practical tool for security evaluation.
• Flexibility: By removing rigid lexical constraints, NTA uncovers vulnerabilities that fixed-target methods miss, providing a more comprehensive assessment of LLM safety.
• Generalizability: The method's effectiveness across diverse models and its robustness against different scoring models and defenses suggest it identifies intrinsic safety weaknesses rather than overfitting to specific model artifacts.

The authors conclude that NTA provides a more principled and efficient approach to evaluating LLM safety, revealing that the reliance on predefined targets in current research significantly underestimates the vulnerability of safety-aligned models.