Technical Summary: SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks

Problem Statement

Large Language Models (LLMs) remain vulnerable to jailbreak attacks, where carefully crafted prompts elicit harmful responses. While optimization-based attacks like Greedy Coordinate Gradient (GCG) have demonstrated effectiveness, they suffer from a fundamental limitation: they restrict adversarial token insertion to a fixed position, typically the suffix (end) of the prompt. This paper posits that this restriction leaves the potential impact of inserting tokens at other positions within the prompt unexplored. The authors argue that assuming the suffix is the optimal attack position creates a research gap, potentially missing more effective and harder-to-detect attack vectors that utilize diverse insertion patterns.

Methodology: SlotGCG

The paper introduces SlotGCG, a novel attack framework that extends GCG by systematically exploring and exploiting "slots"—discrete positions within a prompt where tokens can be inserted (before, between, or after existing tokens). The methodology proceeds through four sequential stages:

1. Probing Slots: To identify vulnerable positions without exhaustive search, the method constructs a probing prompt by inserting unique "probing tokens" into every possible slot of the harmful prompt.
2. Measuring Vulnerability (VSS): The authors introduce the Vulnerable Slot Score (VSS), a metric designed to quantify the susceptibility of specific token positions. VSS is calculated by aggregating attention weights from the "after-chat" template tokens (which directly influence response generation) to the inserted probing tokens. Crucially, this calculation focuses on the upper-half layers of the Transformer architecture, where high-level semantic processing and jailbreak mechanisms are most pronounced.
3. Token Allocation: Based on the VSS, the method computes an insertion probability distribution using a softmax function with a temperature parameter. Adversarial tokens are then allocated across slots proportionally to their VSS, ensuring that more tokens are placed in positions with higher estimated vulnerability.
4. Optimization: Finally, the allocated adversarial sequences are optimized using standard GCG-based gradient-guided search to minimize the loss function and induce harmful responses.

A key finding underpinning this methodology is that vulnerable slots are largely inherent to the prompt itself rather than artifacts of the optimization process. The VSS of a slot remains consistent throughout optimization, allowing the method to identify high-risk positions early with minimal computational overhead (approximately 200ms of preprocessing).

Key Contributions

The paper makes three primary contributions:

• Formalization of Positional Vulnerability: The authors formalize the concept of "vulnerable slots" and introduce the VSS metric to quantify positional vulnerability based on attention patterns, moving beyond the assumption that suffixes are the only effective attack vectors.
• SlotGCG Algorithm: They propose SlotGCG, a position-search mechanism that is attack-agnostic and can be integrated into any optimization-based attack. It targets high-VSS slots to focus adversarial optimization, resulting in faster convergence and higher success rates.
• Empirical Validation: The study provides extensive empirical evidence demonstrating that distributing adversarial tokens across multiple vulnerable slots significantly outperforms suffix-only approaches, offering practical guidance for red teaming and evaluating adversarial robustness.

Experimental Results

The authors evaluated SlotGCG across multiple LLMs (including Llama-2, Llama-3.1, Mistral, Vicuna, and Qwen) and various baseline attack methods (GCG, AttnGCG, I-GCG, GCG-Hij, GBDA).

• Attack Success Rate (ASR): SlotGCG significantly outperformed existing methods. On average, it achieved a 14% higher ASR over GCG-based attacks. For instance, when applied to the I-GCG method on Llama-2-13B, it achieved a 94% ASR compared to the baseline's 56%.
• Efficiency: The method demonstrated faster convergence, requiring significantly fewer optimization steps to succeed. On Llama-2-7B, the average number of iterations dropped from 138.11 (standard GCG) to 40.50 (SlotGCG).
• Robustness Against Defenses: SlotGCG showed superior robustness against input filtering defenses (e.g., Erase-and-Check, Perplexity Filter, SmoothLLM). It maintained an ASR that was 42% higher than baseline approaches under defense conditions. The authors attribute this to the dispersed nature of the attack; even if some tokens are removed or perturbed by defenses, other adversarial tokens in different slots can compensate.
• Universal Transferability: The paper also extended SlotGCG to a universal setting (Universal SlotGCG), learning a single adversarial token sequence that transfers across multiple behaviors. This approach improved cross-behavior transfer rates compared to universal suffix baselines.

Significance and Claims

The paper claims that SlotGCG reveals a previously underexplored dimension of LLM vulnerability: positional vulnerability. By demonstrating that the suffix is not always the optimal attack position, the work challenges the prevailing assumption in the field that adversarial tokens should be appended to the end of prompts.

The authors state that their approach provides a universal mechanism for discovering vulnerable positions that is independent of specific attack strategies. They emphasize that this research contributes to a deeper understanding of LLM safety mechanisms, specifically how attention patterns and token positioning influence model behavior. Consequently, the work aims to inform the development of more robust defense methods by highlighting the need to evaluate and protect against attacks that utilize diverse insertion patterns, not just suffix-based perturbations. The authors note that their findings suggest that current safety mechanisms may be insufficient against attacks that distribute adversarial content across the entire prompt structure.