Technical Summary: Jailbreaking for the Average Jane

Problem Statement

The proliferation of Large Language Model (LLM) jailbreaks has raised concerns that non-expert malicious actors ("the average Jane") could effectively exploit these vulnerabilities to elicit actionable harmful responses. While numerous jailbreak techniques exist, two critical gaps prevent their widespread, effective use by non-experts:

1. Selection Gap: Identifying the optimal jailbreak from a vast, ever-growing set of known techniques for a specific target model without exhaustive (and detectable) probing.
2. Query Gap: Crafting malicious queries that are sufficiently complex to bypass safety training, as simple queries often fail to elicit actionable details from well-aligned models.

This paper investigates whether these gaps can be bridged through automated, principled attack strategies, specifically examining if non-experts can learn optimal jailbreak policies and if queries can be automatically enhanced to increase attack success.

Methodology

The authors propose a two-pronged approach combining online learning for jailbreak selection and automated prompt engineering for query enhancement.

1. Jailbreak Selection via Multi-Armed Bandits

The authors frame the selection of jailbreaks as a sequential decision-making problem solvable via Multi-Armed Bandit (MAB) algorithms.

• Formulation: Given a set of $n$ jailbreaks $\mathcal{J}$ and a sequence of $T$ malicious queries, the attacker acts as a learner. At each step $t$, the learner selects a jailbreak $J(t)$ and observes a binary reward (1 if the response is harmful, 0 otherwise).
• Scenarios:
  • Transfer Attack: The attacker learns a policy (distribution over jailbreaks) on an exploration set $D^{(tr)}$ and applies this fixed policy to a separate exploitation set $D^{(ev)}$. This mimics "best-arm identification."
  • Continual Attack: The attacker updates their policy online during the exploitation phase, jointly performing exploration and exploitation to maximize cumulative reward.
• Algorithms: The study evaluates both partial-information bandit algorithms (e.g., EXP3, Thompson Sampling, LinUCB) and full-information algorithms (Randomised Weighted Majority). Partial-information algorithms are preferred for their computational efficiency, requiring only one query per round rather than $n$ queries.
• Regret: The goal is to achieve sublinear regret, meaning the gap between the attacker's success rate and the best possible jailbreak (in hindsight) vanishes as the number of queries grows.

2. Query Enhancement: FRANKENSTEINBENCH

To address the query complexity gap, the authors introduce FRANKENSTEINBENCH, a safety benchmark containing 11,279 malicious queries.

• Construction: Queries are sourced from 7 existing benchmarks (e.g., AIRBench, WMDP, HarmBench) and enhanced using LLMs.
• Complexity Classification: Queries are categorized as Simple (straightforward malicious requests) or Complex (requests reframed using technical jargon and domain-specific expertise to mask malicious intent).
• Enhancement Strategy: Leveraging the "dual-use dilemma," simple queries are automatically transformed into complex ones using system prompts that instruct the LLM to adopt expert personas (e.g., financial advisors, cybersecurity experts) and use technical terminology.
• Classifier: An ensemble classifier combining readability scores (e.g., Dale-Chall) and an LLM-as-a-judge is used to automatically label query complexity with 89.17% accuracy.

Key Contributions

1. Principled Attack Strategy: A novel threat model utilizing bandit algorithms to efficiently learn optimal jailbreak policies. This approach allows attackers to identify high-performing jailbreaks with sublinear query complexity, avoiding the cost and detection risks of brute-force evaluation.
2. FRANKENSTEINBENCH: A comprehensive safety benchmark of 11,279 malicious queries across six high-stakes domains (Finance, Healthcare, Education, Cybersecurity, Legal, Public-harm). It uniquely distinguishes between simple and complex queries, providing a manually vetted test split and automated complexity labeling.
3. Comprehensive Evaluation: Extensive testing across 15 state-of-the-art open-weight models (ranging from 270M to 120B parameters) and 70 distinct jailbreaks. The study judges approximately 12 million query-response pairs.

Experimental Results

• Bandit Effectiveness: Bandit-based attacks significantly outperform both the "Uniform Priors" baseline (random selection) and the best single static jailbreak.
  • On average, bandit algorithms achieve Attack Success Rates (ASR) as high as 97% across 15 models when using multiple passes (sampling $k=5$ jailbreaks per query).
  • Even with a single pass ($k=1$), bandit methods (e.g., Thompson Sampling, EXP3) substantially outperform the top-performing individual jailbreaks, particularly on models like the gpt-oss family where optimal jailbreaks are non-obvious.
• Impact of Complexity: Complex queries are inherently more dangerous.
  • In the baseline setting (no jailbreak), complex queries achieve an average ASR of 50%, compared to 39% for simple queries.
  • When combined with jailbreaks, complex queries boost ASR by up to 26% on average compared to simple queries.
• Transferability:
  • Cross-Domain: Exploration on non-target domains yields minimal performance loss (approx. 6% difference), suggesting domain-specific exploration is not strictly necessary.
  • Cross-Model: Policies learned on smaller proxy models (e.g., 4B or 12B parameters) transfer effectively to larger target models (e.g., 27B or 70B), often retaining high ASR.
• Robustness: The bandit approach remains effective even when the set of available jailbreaks is pruned to include only the worst-performing 10 jailbreaks, whereas naive baselines fail significantly.

Significance and Claims

The paper argues that the concern regarding non-expert actors successfully attacking deployed LLMs is justified. The combination of automated query enhancement (creating complex, hard-to-detect prompts) and efficient policy learning (via bandit algorithms) creates a highly effective, automatable attack pipeline.

• Safety Implications: The findings suggest that current safety evaluations may be insufficient if they rely on static, simple queries or a single "best" jailbreak. The paper demonstrates that an attacker can dynamically adapt to specific models and leverage query complexity to bypass safety alignment.
• Defense Perspective: The work highlights the need for red-teaming strategies that account for adaptive attackers and complex query structures. It calls for future research into defenses against such automated, multi-stage attacks and the development of safety evaluations that reflect real-world constraints and capabilities of non-expert adversaries.

The authors maintain a modest tone, acknowledging limitations such as the focus on English data, single-turn conversations, and the lack of extensive testing on proprietary models due to cost and access constraints. They position their work as a step toward raising the bar for safety evaluations and inspiring more robust defenses.