ECHO: an optimization-based jailbreak attack that replaces the compliance proxy with response harmfulness

1. 01What problem does this paper attempt to solve?

   Optimization-style jailbreaks only maximize affirmative-prefix likelihood; ECHO instead searches using the harm score of the decoded response.

   Optimization-style jailbreaks maximize affirmative-prefix likelihood, not whether the decoded response is actually harmful.

   • Scenario: the authors state that large language models are already used in high-risk products, yet can still be bypassed by jailbreak prompts that circumvent safety alignment and elicit disallowed content. The authors consider methods that can expose vulnerabilities in deployed APIs and provide adversarial prompts for adversarial fine-tuning, refusal training, and circuit breakers to be important for this reason.
   • Existing shortcomings: manual methods fix exploration into a fixed template; LLM-generated methods pay the attack model's inference cost each round and inherit its style bias. Optimization-style methods need no template or attack model, but GCG, AutoDAN, LARGO all maximize the likelihood that the victim response starts with an affirmative compliance prefix; DSN and AdvPrefix documented this proxy mismatch, but the remedies remain within the compliance-matching family.
   • Core problem: the authors state that this proxy is computed on the prompt, so cautious avoidance and actionable harmful responses can score the same, and the search cannot see what the model actually says. The authors ask: can the search be driven only by the harmfulness of the model's own decoded response; the score must be continuous, computable in a single lightweight forward pass, and based on real harmful capability rather than surface safety cues.
   • This paper proposes: the black-box framework ECHO, which replaces the token-level compliance proxy with a response-level continuous harm score from the 1.7B regressor HarmSig, together with five word-level perturbation operators and a Keyword-Anchored Beam Search with global top-m memory.
   • Threat model:
     • Access: black-box to the target LLM, can submit prompts and observe generations, with no parameters or gradients.
     • Exclusions: victim model gradients, logits or probabilities, auxiliary attack LLM, predefined jailbreak templates, fixed affirmative target string, multi-turn interaction.
     • Goal: map a harmful intent xmal to xadv such that the single-turn response y=M(xadv) is judged harmful under the scoring objective; no dialogue history.
     • Authors' positioning: the authors state that in Appendix Table 8, ECHO is the only method that simultaneously satisfies these six conditions.

   Collapse this answer

2. 02What related research exists?

   The authors divide jailbreaks into three types—manual, LLM-generated, and optimization-style—and criticize the latter type for sharing a compliance proxy.

   The authors group by whether optimization-style search is performed, and collapse optimization-style methods onto the same compliance proxy template.

   Manual and rule-based jailbreaks

   • Fixed transformations: FlipAttack (Liu et al., 2025) does text flipping, ArtPrompt (Jiang et al., 2024) uses ASCII encoding, Speak Easy (Chan et al., 2025) does multi-step multilingual interaction; there is also few-shot role framing (Zheng et al., 2025), and M2S (Ha et al., 2025), which compresses multi-turn dialogue into a single turn. The introduction also lists Wei et al. (2025), Zhou et al. (2024), and Anil et al. (2024) among related constructions.
   • The authors' criticism: the authors state that the strategy is fixed in fixed transformations or prompt patterns, with no adaptive generation loop, that diversity is limited by human creativity, and that once the surface pattern is recognized it can be patched.

   LLM-generated jailbreaks

   • Attack-model rewriting: PAIR (Chao et al., 2025) and TAP (Mehrotra et al., 2024) use social engineering or tree search, delegating prompt generation to an attack LLM.
   • Other generators: GASP (Basani and Zhang, 2025) does Bayesian optimization in semantic embedding space; RedAgent (Xu et al., 2026a) adds multi-agent self-reflection; Jailbreak-R1 (Guo et al., 2025) uses reinforcement learning to pursue diversity; AdvPrompter (Paulus et al., 2025) trains a generator to optimize toward a token-level objective.
   • The authors' criticism: the authors state that they alleviate the static-template bottleneck, but each round pays the inference budget of the attack model, and they may be blocked by the attack model's own safety alignment (Kritz et al., 2025).

   Optimization-style jailbreaks

   • Search mechanisms: GCG (Zou et al., 2023) combines greedy coordinate and gradient to find a universal adversarial suffix; I-GCG (Jia et al., 2025) expands diverse target templates; AutoDAN (Liu et al., 2024) uses a hierarchical genetic algorithm; LARGO (Li et al., 2025) does gradient optimization on continuous latent vectors. ADC (Hu et al., 2024) connects discrete and continuous optimization with dense-to-sparse constraints; CRI (LeVi et al., 2025) improves GCG initialization along the compliance direction.
   • Shared objective: the authors state that despite different procedures, the common template is supervision by a token-level compliance proxy rather than the harmfulness of the full decoded response. Affirmative-prefix likelihood drives GCG and AutoDAN; DSN (Zhou et al., 2025) adds refusal-token suppression; AdvPrefix (Zhu et al., 2025) refines the prefix objective per model; LARGO places a compliance-style objective in latent space; TAO-Attack (Xu et al., 2026b) penalizes pseudo-harmful completions but still retains first-stage prefix supervision.
   • Boundary with this paper: the authors state that AdvPrefix and DSN documented the proxy mismatch but remain within that family; ECHO instead uses HarmSig to rank the victim model's full decoded responses.

   Experimental baselines and benchmarks

   • Comparisons: the main-experiment baselines are FlipAttack, DeepInception, PAIR, GCG, AutoDAN, and DSN. The benchmarks are AdvBench (520 harmful behaviors) and the standard 200-behavior subset of HarmBench (six categories).

   The authors position this paper as: rather than maximizing affirmative-prefix likelihood, using a response-level harm score to drive black-box, single-turn search with no attack model and no template.

   Collapse this answer

3. 03How does the paper address this problem?

   Freeze HarmSig and the operator weights offline; online, use word-level perturbations plus beam search to maximize the response harm score.

   Prepare offline once and freeze HarmSig and the operator weights; online, use keyword-constrained beam search to maximize the response-level harm score.

   Problem setting

   • Optimization objective: the set of prompts reachable from the malicious target xmal via the search in Sections 3.3–3.4 is denoted X(xmal). The objective is written as x^∗_adv=argmax_{x∈ X(xmal)} F(M(x)), where F maps a response to [0,1], i.e., HarmSig's score on the full decoded response.
   • No prefix objective: the authors state that the affirmative target string is only a compliance proxy; after removing it, the objective does not constrain the response's word form and only looks at what the decoded content actually provides.
   • Procedure: Figure 2 is offline preparation, Figure 3 is the online loop. Single-turn, no dialogue history; the six access exclusions are given in Question 1.

   HarmSig and operator weights

   • Regressor: the backbone is Qwen3-1.7B, with LoRA added to the attention projections; the final-token hidden state goes through a two-layer MLP and then a sigmoid. During search, one forward pass is done over the response text, encoding only the response.
   • Teacher: victim responses on 29,744 real jailbreak trajectories, with labels being the average score of Qwen3.5-27B, GPT-OSS-Safeguard-20B, and Gemma-4-26B-A4B-IT. MSE is used instead of binary cross-entropy to preserve the ordering of nearby candidates.
   • Training data: candidate targets are deduplicated against AdvBench and HarmBench by character 5-gram Jaccard with threshold 0.88. 4,460 are held out for validation, 25,284 are used for training, truncated to 1,024 subwords. Appendix B gives details such as AdamW, LoRA r=16, and three epochs; the checkpoint is selected by Spearman correlation on the validation set.
   • Weights: w is tuned only once on the simplex. The validation pool in Figure 2 is 100 malicious targets, and the probe model is Llama-2-7B-chat. The coordinate z lies in a four-dimensional interval [-4,4], and a softmax (with the fifth logit pinned) yields the five operator probabilities; a Gaussian process with expected improvement maximizes the average of the highest F over each target's trajectory. In the large experiments the weights are fixed.

   The five word-level operators

   • Keyword set K: before search, non-stopword content words and their WordNet synonyms are taken from xmal, and fixed thereafter. Both the operators and the feasibility filter act on K, to preserve the semantic identity of the malicious intent.
   • Substitution type: CORE substitution replaces a word in K with another word from that word's synonym set; PERIPH substitution replaces a peripheral content word outside K. Each step samples only one operator, producing a one-hop neighbor.
   • The other three types: PRESSURE inserts, at a sampled position, a short modifier that asks for more specificity, more steps, or a softer tone; DELETE deletes only when it passes the keyword feasibility check; SWAP swaps two adjacent non-protected words. The authors state that SWAP is the word-level Damerau–Levenshtein transposition.

   Keyword-Anchored Beam Search

   • Expansion: beam width at most k. Each prompt samples b children according to w; those infeasible on keywords are discarded, and the remaining full responses are scored by F.
   • Memory and stopping: the top k children enter the next depth; all accepted children are merged into the global top-m buffer H. At most T steps, or stop when any response reaches threshold α. Algorithm 1 returns the best prompt in H.
   • Queries: the top-m responses are already decoded and cached during search, so reporting best-of-m does not query the victim model further. The authors state that other explorers could replace the width-limited layer, but in their ablation the beam search variant had the best trade-off, so that variant is adopted.
   • Default parameters: unless otherwise stated, k=10, b=5, T=20, α=0.8, m=25. Starting from the original malicious target, no jailbreak template is used.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On five open-source victim models, ECHO's top-m=25 is higher than each baseline in Table 1 on both SR and HB.

   Experimental setup

   • Victim models: Llama-2-7B-Chat, Llama-2-13B-Chat, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Gemma-3-12B-IT. Appendix H additionally transfers the obtained prompts zero-query to GPT-5.4.
   • Data: AdvBench is 520 harmful behaviors, covering illegal activity, violence, fraud, and privacy invasion. HarmBench is the standard 200-behavior subset, six categories: Chemical & Biological, Cybercrime, Harassment, Harmful, Illegal, Misinformation.
   • Baselines and selection: FlipAttack, DeepInception, PAIR, GCG, AutoDAN, DSN. top-m=1 is the single-output comparison; top-m=25 takes the best one in global memory. These 25 were already generated and cached in the same search, with no additional victim-model queries.
   • Metrics: StrongREJECT (SR) is a continuous score in [0,1], which the authors state is used to mitigate the over-refusal bias of keyword-based ASR. HarmBench (HB) is the binary classifier success rate (%). The authors state that two structurally different judges are used to avoid fitting only a single calibration.
   • ECHO budget: k=10, b=5, T=20, α=0.8, m=25; the weights are fixed after Bayesian optimization on the validation pool. The authors state that the default configuration uses at most 1000 victim-model queries per target, averaging 877 after early stopping.
   • Judges and repetitions: the paper does not state the model versions or decision thresholds of the StrongREJECT and HarmBench classifiers, nor the number of random repetitions in the main experiments. The human part is a blind evaluation by two annotators.

   Main results

   The table below is based on Table 1. Cells are SR / HB (%). The five rows are all victim models. The GCG, AutoDAN, and DeepInception rows are omitted to avoid exceeding the column count.

   Swipe horizontally to read the table

   Model	ECHO m=25	ECHO m=1	DSN	PAIR	FlipAttack
   Llama-2-7B-Chat	0.835 / 78.27%	0.685 / 58.27%	0.385 / 54.42%	0.320 / 21.15%	0.104 / 10.19%
   Llama-2-13B-Chat	0.821 / 75.19%	0.685 / 58.46%	0.174 / 17.69%	0.367 / 25.58%	0.238 / 28.85%
   Llama-3.1-8B-Instruct	0.857 / 80.38%	0.710 / 65.96%	0.357 / 40.00%	0.518 / 53.46%	0.239 / 26.92%
   Qwen2.5-7B-Instruct	0.898 / 89.23%	0.780 / 71.92%	0.568 / 64.81%	0.510 / 48.27%	0.378 / 35.00%
   Gemma-3-12B-IT	0.702 / 81.54%	0.525 / 52.69%	0.161 / 6.15%	0.168 / 17.50%	0.602 / 65.00%

   • Compliance proxy: the authors state that on safety-tuned Llama-3.1, attacks targeting affirmative-prefix likelihood plateau: the model still gives affirmative openings to many adversarial suffixes, but the body remains evasive; the proxy records success, while StrongREJECT gives a low score. In Table 1 cells not listed above, on this model GCG is 0.303 / 30.00% and AutoDAN is 0.045 / 0.58%.
   • Other baselines: the authors state that DSN's auxiliary signal remains sensitive to the alignment regime; PAIR is another method mentioned in the text that is competitive on Llama-3.1, but requires an auxiliary attack LLM at inference. ECHO top-m=1 leads on four models, and is lower than FlipAttack only on Gemma-3-12B-IT; top-m=25 returns to the lead on that model. The authors state that no baseline exceeds 65%; the highest baseline HB cell in the table above is FlipAttack on Gemma-3-12B-IT. According to Table 1, the three omitted rows have lower SR and HB than ECHO top-m=25 on the same model.
   • Memory and saturation: the authors state that the global top-m recovers high-scoring prompts discarded by beam pruning, so top-m=25 is higher than top-m=1 on every victim model. The authors state that in Figure 4 the SR and HB curves saturate around m≈20–25, and the model ranking is consistent for four of five on the two metrics; the figure caption says saturation around m≈25. In Table 10 there is still an increase after m=25, e.g., Qwen2.5-7B at m=100 has SR 0.907 and HB 91.35%; the authors state that at that table's precision, there is no further change after m>100.

   Scorer ablation

   • Setup: Table 3 changes only the inner scoring function; the search loop, operator pool, victim model, budget, and evaluation protocol are unchanged. n=100 targets, victim model Llama-2-7B-Chat. The four scorers are Random, keyword coverage, compliance proxy, and HarmSig. The compliance proxy applies a sigmoid (shifted by 5) to the average log-probability of affirmative-prefix tokens and requires white-box logits; the other three do not.
   • Results: SR / HB (%) are Random 0.062 / 1, Keyword 0.099 / 2, compliance proxy 0.253 / 8, HarmSig 0.793 / 59. Wall-clock times are 73.96, 74.48, 81.90, and 81.80 seconds/target respectively.
   • Authors' interpretation: the order the authors give is Random below Keyword, then below compliance proxy, then below HarmSig. The authors state that keyword is only slightly above random because a response can contain the target words without providing executable content; the compliance proxy, despite having white-box logits, scores about one third of HarmSig, and can elicit affirmative openings but cannot steer the body toward genuinely harmful content. The authors treat StrongREJECT as the primary metric here: Gemma-3-12B-IT more often gives insufficiently specific malicious responses, which binary HB counts as a jailbreak while SR gives a low score.

   Cross-model transfer

   • Setup: Table 2 expands the beam with HarmSig on the source model, then freezes the top-m=25 prompts per target, does no further search, and evaluates them directly on the target model. n=520. Cells are SR@25 / HB@25 (%).
   • Results: Llama-2-7B and Llama-2-13B transferring to each other gives SR 0.661–0.674. With Gemma-3-12B-IT as source, Qwen2.5-7B is 0.786 / 65.00% and Llama-3.1-8B is 0.741 / 60.77%. With Qwen2.5-7B as source, the Llama-2 family is 0.436–0.458 SR and Llama-3.1-8B is 0.690 SR.
   • Authors' interpretation: the authors believe that models sharing alignment training inherit similar surface patterns that trigger refusal; and that optimizing on a more capable victim model yields prompts targeting a different vulnerability region than prompts tuned on Llama-2. The authors state that the off-diagonal entries are not close to zero, and interpret this as the prompts carrying transferable adversarial structure rather than source-model traces.

   Human verification and closed-source zero-query

   • Human: two annotators independently rate ECHO's top-m=1 outputs without seeing HarmSig, SR, or HB. Same 100 targets as the ablation, models Qwen2.5-7B-Instruct and Llama-2-13B-Chat, 200 total (Table 6). HB / annotator A / annotator B: Qwen 80% / 78% / 80%, Llama-2-13B 62% / 63% / 65%, combined 71.0% / 70.5% / 72.5%. Table 7: HB vs A agreement 94.5%, Cohen's κ=0.87; HB vs B 91.5%, 0.79; A vs B 95.0%, 0.88. The authors state that both annotators closely follow HarmBench.
   • GPT-5.4: Appendix H, Table 13, the same 100 AdvBench targets. Prompts come from the Llama-2-7B-Chat experiment and are ranked by HarmSig, with no target-side search. top-m=1 is SR 0.165, HB 0.0%; top-m=25 is SR 0.564, HB 10.0%.
   • Runtime: Table 5 on Llama-2-7B-Chat, 100 AdvBench targets, NVIDIA RTX PRO 6000, average seconds per target are AutoDAN 357.15, GCG 126.23, DSN 63.22, ECHO 81.80. The authors state that ECHO is faster than GCG and AutoDAN and slower than DSN.

   Other ablations and analyses

   • Search strategy (Table 4, Llama-2-7B-Chat, n=100, HarmSig fixed, 20 steps, 50 target evaluations per step): SA is 0.161 / 5%, Greedy is 0.376 / 21%, plain Beam is 0.626 / 48%, ECHO is 0.793 / 59%. The authors state that SA is led by the Boltzmann acceptance criterion to weaker candidates; ECHO adds keyword feasibility, BO weights, and global memory relative to plain beam, and the authors give +0.167 average SR and +11 HB percentage points.
   • HarmBench categories (Table 12, top-m=25, n=200): the authors state that Harassment is the hardest, with Llama-2-13B at 42.1% and Gemma-3-12B at 47.4%; Qwen's Chemical & Biological and Cybercrime are both 100.0%, and Llama-3.1-8B's Cybercrime is 100.0% and Chemical & Biological 78.6%. Gemma's Misinformation is SR 0.534, HB 97.1%.
   • Multilingual (Appendix F, the same 100 targets translated into French/German, Qwen2.5-7B-Instruct, original operator marginals retained): French top-m=1 is 0.627 / 70%, top-m=25 is 0.806 / 92%; German is 0.661 / 85% and 0.884 / 97%.
   • Query reduction (Appendix G, Llama-2-7B-Chat, 100 targets): independent reruns of the baseline average 871.50 queries (the authors state it is not 877 due to randomness), reduced to 779.28 queries, a 10.58% reduction (95% CI [5.81, 15.14]); time goes from 81.80 seconds to 70.06 seconds. top-m=1 SR/HB goes from 0.784 / 67% to 0.736 / 64%, and top-m=25 from 0.883 / 84% to 0.867 / 83%. The authors state that the paired confidence intervals for the quality difference all include zero.
   • HarmSig validation (Table 9, 4,460): epoch 3 Spearman ρ=0.846, RMSE 0.164, MAE 0.105, accuracy 0.896 and F1 0.820 at threshold 0.5.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors point out that independent safety classifiers, query budget, and Chinese/Japanese tokenization limit closed-source and multilingual use.

   Limitations noted by the authors and future directions

   • Commercial classifiers: the authors state that commercial systems combine model alignment with independent input/output safety classifiers, which would further reduce ECHO's attack success rate. (Limitations)
   • Query budget: the authors state that ECHO's query budget is large, making direct optimization against such APIs costly. (Limitations)
   • Closed-source transfer: the authors state that zero-query transfer avoids the optimization cost, but transfer to GPT-5.4 gives a HarmBench success rate of 10.0% at top-m=25 (Appendix H); these unobserved safety objectives remain a limitation for closed-source deployment. (Limitations)
   • Writing systems: the multilingual evaluation covers only French and German. The authors state that extending to non-alphabetic or mixed writing systems such as Chinese and Japanese remains difficult, because word-level operators and keyword constraints depend on reliable tokenization and lexical resources, and coverage of technical terms and neologisms may also be limited. (Limitations)

   Scope of the experiments

   • The main-result victim models are Llama-2-7B-Chat, Llama-2-13B-Chat, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Gemma-3-12B-IT; AdvBench is 520. HarmBench is the standard 200 behaviors, six categories, and Appendix D gives the classification results for top-m=1 and top-m=25.
   • The baselines are FlipAttack, DeepInception, PAIR, GCG, AutoDAN, DSN; the metrics are StrongREJECT and the HarmBench classifier success rate. The paper does not report the model versions or decision thresholds of these two judges, nor the number of random repetitions in the main experiments.
   • The scorer ablation and the search ablation are both on 100 targets of Llama-2-7B-Chat (Table 3, Table 4). Cross-model transfer is a 5×5 grid, n=520, top-m=25 per target (Table 2).
   • Human verification is two blind annotators, 200 top-m=1 responses, 100 each from Qwen2.5-7B-Instruct and Llama-2-13B-Chat (Table 6–7).
   • Appendix F evaluates Qwen2.5-7B-Instruct on French and German translations of the same 100 targets. Appendix H transfers prompts obtained from Llama-2-7B-Chat search zero-query to GPT-5.4, with no target-side re-search.

   Collapse this answer

6. 06Summarize the main content of the paper

   ECHO uses HarmSig's response harm score to drive black-box beam search, and top-m=25 is higher than the baselines listed in Table 1.

   ECHO is a black-box optimization-style jailbreak framework that replaces affirmative-prefix likelihood with the harm score of the decoded response.

   • Problem: methods such as GCG, AutoDAN, LARGO maximize the likelihood that the victim model starts with an affirmative compliance prefix. The authors state that this proxy does not distinguish cautious avoidance from actionable harmful responses. ECHO aims to search only by the harmfulness of the complete response, in a single-turn black-box setting with no gradients, no logits, no attack model, no template, and no fixed prefix target.
   • Method: three frontier teachers score 29,744 trajectory responses with an average score, distilling a 1.7B regressor HarmSig; Bayesian optimization calibrates the sampling weights of five word-level operators on a validation pool of 100 targets. Online search uses keyword feasibility filtering, with default beam width 10, branches 5, depth 20, early-stop threshold 0.8, global memory 25, maximizing HarmSig.
   • Main results: on AdvBench, ECHO's top-m=25 is higher than the Table 1 baselines on both SR and HB across five open-source victim models. Qwen2.5-7B-Instruct is SR 0.898, HB 89.23%; the HB range given by the authors is 75.19%–89.23%. top-m=1 is lower than FlipAttack on Gemma-3-12B-IT, and top-m=25 returns to the lead.
   • Controlled experiments: with the same search loop, Llama-2-7B-Chat, n=100, HarmSig is SR 0.793, HB 59%, while the compliance proxy requiring white-box logits is 0.253, 8% (Table 3). After freezing the prompt, the Gemma-3-12B-IT source on Qwen2.5-7B is 0.786 / 65.00% (Table 2, n=520). Zero-query transfer to GPT-5.4 gives an HB of 10.0% (Appendix H, top-m=25, 100 targets).
   • Authors' conclusion: the authors state that the gain comes from the scoring function, not the rest of the search design; the resulting prompts transfer across model families. The authors further state that once the search signal looks at the decoded response, current safety alignment remains fragile to surface edits.

   Collapse this answer

Related papers