TASO: Jailbreaking Large Language Models via Alternating Optimization of Templates and Suffixes

Researchers propose a jailbreak method named TASO that alternately optimizes semantic templates and attack suffixes to induce large language models to answer harmful questions. Its core idea is that the two types of optimization are complementary: suffix optimization can control the first few tokens of the output but cannot control the overall output quality, while template optimization can guide the entire output but struggles to control the starting tokens, and the starting tokens significantly affect subsequent responses; combining the two can improve attack effectiveness. The authors evaluate on the HarmBench and AdvBench benchmarks against 24 mainstream models (including the Llama series and models from OpenAI and DeepSeek), and results show that TASO can effectively jailbreak existing large language models.