EasyJailbreak: A Unified Framework for Jailbreaking Large Language Models

1. 01What problem does this paper attempt to solve?

   Jailbreak attacks lack a unified implementation framework, making fair comparison difficult; the authors propose the four-component framework EasyJailbreak and evaluate 10 LLMs.

   Core problem: jailbreak attack methods vary widely and there is no standard implementation framework, making it impossible to fairly compare and comprehensively evaluate LLM security vulnerabilities.

   • Problem setting and importance: The authors consider jailbreak attacks to aim at bypassing safety guardrails and inducing models to output prohibited content, which is crucial for identifying and mitigating LLM security vulnerabilities (Figure 1 shows a comparison of model outputs with and without jailbreak prompts).
   • Shortcomings of existing methods: The authors state that jailbreak methods are often evaluated on different data samples and victim models, making direct fair comparison difficult; and because source code is lacking, reproducing prior work is time-consuming and error-prone.
   • Core observation of the paper: The authors consider that most jailbreak methods can be decomposed into four basic components—Selector, Mutator, Constraint, Evaluator—and thus assembled modularly.
   • What the paper proposes: It proposes a unified framework, EasyJailbreak, which supports reproduction and benchmarking of 11 jailbreak methods and conducts safety evaluation on 10 LLMs; the authors state that a web platform, a PyPI package, and experimental outputs have been released.
   • Threat model:
     • Attacker goal: Bypass the model's safety mechanisms so that the model produces prohibited outputs in response to jailbreak instructions (queries, i.e., instructions the model should not respond to).
     • Attacker capability: Construct initial prompt templates (seeds), iteratively rewrite attack inputs through the Mutator, and filter using the Selector and Constraint.
     • Victim systems: Open-source models (such as LLaMA2, Vicuna) and closed-source models (such as GPT-4).
     • Knowledge assumptions: Not uniformly stated in the paper; each attack recipe follows the settings of its original paper, e.g., GCG uses model gradients, while PAIR and others iterate through queries.

   Collapse this answer

2. 02What related research exists?

   Related work is organized into three categories of jailbreak attacks: manually designed, long-tail encoding, and prompt optimization; the paper also cites several defense works.

   Human Design

   • Role-playing and scenario construction: role-playing by Li et al. (2023a), and DeepInception scenario construction by Li et al. (2023b), which induce the model to ignore system guidelines.
   • In-context learning vulnerabilities: Shayegani et al. (2023) and Wei et al. exploit vulnerabilities in the model's in-context learning to induce it to respond to malicious instructions (ICA).
   • In-the-wild jailbreak prompts: Shen et al. (2023) characterize and evaluate real-world jailbreak prompts (the jailbreak example in Figure 1 is taken from that work).

   Long-tail Encoding

   • Idea: Wei et al. (2023) point out that models have limited generalization to data unseen in safety alignment, but due to the large scale of pretraining they can still understand intent and generate unsafe content.
   • Representative methods: MultiLingual (Deng et al., 2023b) encodes inputs into low-resource languages; CodeChameleon (Lv et al., 2024) encrypts inputs and embeds a decoding function in the prompt; Cipher (Yuan et al., 2023) uses cipher dialogue.

   Prompt Optimization

   • Gradients and evolution: GCG (Zou et al., 2023) uses model gradients; AutoDAN (Liu et al., 2023) uses a genetic algorithm to evolve prompts.
   • Fuzzing and iterative rewriting: GPTFUZZER (Yu and Lin) and FuzzLLM (Yao et al., 2023) explore prompt variants; PAIR (Chao et al., 2023) iteratively refines based on model scores; ReNeLLM (Ding et al., 2023) is nested rewriting; TAP (Mehrotra et al., 2023) is a tree-structured attack.
   • Persuasion and auxiliary models: PAP (Zeng et al., 2024) uses natural language to persuade the model; Deng et al. (2023a) train an auxiliary model to generate jailbreak prompts, with success rate as the reward.

   Defenses and positioning

   • Defense work: In the Introduction, the paper cites defense strategies such as Jain et al. (2023), Helbling et al. (2023), Robey et al. (2023), and Cao et al. (2023), listing them only as background.
   • Baselines and benchmarks: The experiments evaluate 11 attack recipes on AdvBench (Zou et al., 2023); the baselines for the evaluator comparison are Rule Match, the GPTFUZZER classifier, Llama-Guard-7B, and ChatGPT (Table 3).
   • Positioning of this paper: The authors state that EasyJailbreak is the first to enable these attacks to be benchmarked, compared, and analyzed within a unified framework.

   Collapse this answer

3. 03How does the paper address this problem?

   Decomposes jailbreak attacks into four components—Selector, Mutator, Constraint, and Evaluator—assembles 11 attacks according to recipes, and outputs reports.

   Overall approach: decompose various jailbreak attacks uniformly into four reusable components; by combining components, researchers can assemble new attacks or reproduce old ones. The framework is named EasyJailbreak, and the pipeline has three stages: preparation, attack, and output (Figure 2).

   Problem setting and preparation stage

   • Three types of input: queries are jailbreak instructions that the model should not respond to; seeds are initial prompt templates used to improve ASR; models usually serve as attack targets, and can also be used to evaluate results or generate new templates.
   • Adjustable parameters: users can adjust the attack recipe or component hyperparameters.

   Four core components

   • Selector: selects the most promising candidates when candidates explode, e.g., EXP3SelectPolicy uses the Exp3 algorithm to select seeds; others include UCB, RoundRobin, MCTSExplore, SelectBasedOnScores, ReferenceLossSelector, etc. (Appendix A.1).
   • Mutator: rewrites the attack input when rejected, in three categories: generative (e.g., ApplyGPTMutation, Translation), gradient-based (uses reference responses to compute gradients and update tokens), rule-based (e.g., Base64, CaserExpert) (Appendix A.2).
   • Constraint: filters out inputs doomed to fail, e.g., DeleteHarmLess uses an LLM to assess harmfulness and remove harmless inputs, DeleteOffTopic removes off-topic inputs, PerplexityConstraint removes high-perplexity inputs (Appendix A.3).
   • Evaluator: automatically determines whether an attack succeeded, in three categories: classifier-based (ClassificationJudge, ClassificationGetScore, 0–9 score), generative-model-based (GenerativeJudge, GenerativeGetScore), rule-based (Match, PatternJudge, PrefixExactMatch) (Appendix A.4).

   Attack recipes and reproduction

   • 11 recipes: Table 1 lists the component combination of each attack, e.g., ReNeLLM uses RandomSelector + 6 Mutators + DeleteHarmLess + GenerativeJudge; GPTFUZZER uses 4 Selectors + 5 Mutators + ClassificationJudge; GCG uses ReferenceLossSelector + MutationTokenGradient + PrefixExactMatch.
   • Hyperparameter sources: the hyperparameters of each recipe follow the settings of the original paper.

   Output and usage

   • Report: a report is generated after each attack, containing the success rate, response perplexity, and for each malicious query the model response, jailbreak prompt, and evaluation details.
   • Interface: runs with a few lines of code (the example tests Vicuna-13B with PAIR, with GPT-4 as the attack and judge model); there is also a web platform for comparing outputs of different attacks (Figure 3).

   Success determination

   • Unified judge: the benchmark experiments use GenerativeJudge as the unified judging method, with GPT-4-turbo-1106 as the scoring model and the judging prompt taken from GPTFUZZER.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Evaluated 10 LLMs on AdvBench with 11 attacks, with an average ASR of 63%; also compared 5 evaluators and attack efficiency.

   Experimental setup

   • Models tested (10): GPT-4-0613, GPT-3.5-Turbo, LLaMA2-7B-chat, LLaMA2-13B-chat, Vicuna-7B-v1.5, Vicuna-13B-v1.5, Qwen-7B-chat, InterLM-chat-7B, ChatGLM3, Mistral-7B-v0.1, from 7 organizations.
   • Dataset: AdvBench (Zou et al., 2023); the paper does not state the number of samples used.
   • Attack recipes (11): manually designed: JailBroken, DeepInception, ICA; long-tail encoding: Cipher, MultiLingual, CodeChameleon; optimization: ReNeLLM, GPTFUZZER, AutoDAN, PAIR, GCG; hyperparameters follow each original paper.
   • Metrics: ASR (attack success rate); judge comparison uses Accuracy, TPR, FPR, F1, and time.
   • Judging method: uniformly GenerativeJudge, with GPT-4-turbo-1106 as the scoring model and the judging prompt from GPTFUZZER.
   • Sample size and number of repetitions: the judge comparison uses 400 manually annotated responses; the paper does not report the number of repetitions for the main experiments.

   Main results

   According to Table 2 (ASR, %):

   Swipe horizontally to read the table

   Model	Avg.	JailBroken	DeepInception	ICA	CodeChameleon	MultiLingual	Cipher	AutoDAN	PAIR	GCG	ReNeLLM	GPTFUZZER
   GPT-3.5-turbo	57	100	66	0	90	100	80	45	19	12	87	35
   GPT-4-0613	33	58	35	1	72	63	75	2	20	0	38	0
   Llama2-7B-chat	31	6	8	0	80	2	61	51	27	46	31	31
   Llama2-13B-chat	37	4	0	0	67	0	90	72	13	46	69	41
   Vicuna7B-v1.5	77	100	29	51	80	94	28	100	99	94	77	93
   Vicuna13B-v1.5	83	100	17	81	73	100	76	97	95	94	87	94
   ChatGLM3	77	95	33	54	92	100	78	89	96	34	86	85
   Qwen-7B-chat	74	100	58	36	84	99	58	99	77	48	70	82
   Intern7B	71	100	36	23	71	99	99	98	86	10	67	92
   Mistral-7B	88	100	40	75	95	100	97	98	95	82	90	99

   • Universally vulnerable: the authors state that the average breach probability across the 10 models is 63% (the abstract and conclusion say 60%), and GPT-3.5-Turbo and GPT-4 are not immune either.
   • Relative advantage of closed-source: the authors state that the average ASR of GPT-3.5-Turbo and GPT-4 is 45%, lower than 66% for the remaining open-source models; but the safety of the Llama2 series is comparable to GPT-4.
   • Scale does not equal safety: on Llama2 and Vicuna, the 13B versions have slightly higher average jailbreak success rates than the 7B versions; the authors argue that increasing parameter count does not necessarily improve safety.

   Judge comparison

   • What was measured: accuracy and efficiency of 5 judging methods on 400 manually annotated responses (Table 3).
   • Results: GPT4-turbo accuracy 93.50%, TPR 94.38%, F1 93.43%, time 12 minutes; GPTFUZZER classifier accuracy 90.50%, FPR 3.92% (lowest), time 15 seconds; Rule Match is fastest (1 second) but FPR 40.20%; Llama-Guard-7B accuracy 79.75%; ChatGPT accuracy 85.50%.
   • Authors' interpretation: GPT-4 is accurate but slow; the classifier balances efficiency and accuracy; rule matching has high FPR because it is strict and cannot adapt to diverse responses; choosing a judging metric requires balancing accuracy and efficiency.

   Attack efficiency analysis (Appendix B)

   • What was measured: Figure 4 gives the ASR and time of each attack on Llama2-7B and Llama2-13B.
   • Results: manually designed attacks require only manually written prompts and take the least time; Prompt Optimization-type attacks take the longest, requiring 764.4 hours and 803.9 hours on Llama2-7B-chat and Llama2-13B-chat respectively, but have higher success rates on Llama2.
   • Exception: MultiLingual performs poorly on Llama2 (2% for 7B, 0% for 13B), which the authors attribute to Llama2's limited multilingual ability; Cipher achieves 61% and 90% on Llama2-7B-chat and Llama2-13B-chat respectively, which the authors attribute to Llama2's language processing ability not being covered by safety optimization.

   Other ablations and analyses

   • The paper does not report other systematic ablations; the component combinations of each attack recipe are in Table 1, hyperparameters follow the original papers, and no additional parameter sweeps were performed.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors only propose to verify the scaling conclusion on larger models; the experiments cover 10 models, 11 attacks, and a single dataset.

   Limitations and future directions noted by the authors

   • Validation on larger models: The authors state that future work will conduct further safety validation on larger-scale models such as Llama2-Chat-70B, to test the conclusion that "increasing the number of parameters does not necessarily improve safety" (Section 5.2).
   • Apart from this, the paper does not list other explicit limitations or future directions in the Conclusion or appendix.

   Scope of experimental coverage

   • Models tested: 10 in total, namely GPT-4-0613, GPT-3.5-Turbo, LLaMA2-7B-chat, LLaMA2-13B-chat, Vicuna-7B-v1.5, Vicuna-13B-v1.5, Qwen-7B-chat, InterLM-chat-7B, ChatGLM3, Mistral-7B-v0.1 (Section 5.1).
   • Attack recipes: 11, covering three categories: human design, long-tail encoding, and prompt optimization; the framework itself claims to support 12 attacks (Introduction), but the benchmark experiments used 11 (Table 2).
   • Dataset: AdvBench only; the paper does not state the number of samples used (Section 5.1).
   • Evaluation method: Uniformly uses GPT-4-turbo-1106's GenerativeJudge; the evaluator comparison is based on 400 human-annotated responses, and the paper does not report annotator agreement (Section 5.3).
   • Unreported information: The number of repetitions in the main experiments, and the number of queries or token consumption for each attack on the 10 models, are not reported; efficiency data are given only for the two models Llama2-7B/13B (Appendix B).

   Collapse this answer

6. 06Summarize the main content of the paper

   EasyJailbreak uniformly reproduces 11 jailbreak attacks with four components; across 10 LLMs evaluated, the average ASR is 63%, and for GPT-4 it is 33%.

   A paper on a jailbreak attack framework: addressing the problem that jailbreak methods lack standard implementations and are difficult to compare fairly, the authors propose a unified framework, EasyJailbreak.

   • Problem to solve: Jailbreak methods are evaluated on different data and models, and missing source code makes reproduction difficult, hindering the identification and mitigation of LLM vulnerabilities (the authors' view).
   • Method highlights: Decompose attacks into four components—Selector, Mutator, Constraint, Evaluator—and reproduce 11 attacks through component composition (Table 1); the framework has three stages: preparation, attack, and output, with the output including a report of ASR and per-query details, and provides a web platform and a PyPI package.
   • Main results:
     • On AdvBench, with GPT-4-turbo-1106 as the unified evaluator, the average ASR across 10 models is 63% (Table 2; the abstract and conclusion state 60%).
     • The average ASR of GPT-3.5-Turbo and GPT-4-0613 is 57% and 33%, respectively; Mistral-7B is highest (88%), and Llama2-7B-chat is lowest (31%).
     • The authors state that closed-source models have an average ASR of 45%, lower than the 66% of open-source models, but the Llama2 series has safety comparable to GPT-4.
     • Evaluator comparison (400 human-annotated responses): GPT4-turbo has an accuracy of 93.50% but takes 12 minutes, while the GPTFUZZER classifier has 90.50% and takes only 15 seconds (Table 3).
   • Authors' conclusion: Contemporary LLMs have widespread security vulnerabilities and urgently need stronger safety defenses; the authors believe EasyJailbreak can provide researchers with a tool for evaluating and developing attack and defense strategies, and plan to continue validation on larger models such as Llama2-Chat-70B in the future.

   Collapse this answer

Related papers