Super Suffixes: Simultaneously Bypassing Text Generation Alignment and Guardrail Models

Researchers propose adversarial suffixes named Super Suffixes that can simultaneously cover multiple alignment objectives across multiple models with different tokenization schemes, and through a joint optimization method bypass Llama Prompt Guard 2 on five text generation models, achieving malicious text and code generation. The authors state that to their knowledge this is the first work revealing that Llama Prompt Guard 2 can be broken by joint optimization. The authors also propose a lightweight detection method, DeltaGuard, which uses the cosine similarity between the residual stream and specific concept directions as a fingerprint of model intent, and state that it raises the classification rate of non-benign prompts to near 100%.