ECHO: a jailbreak attack that replaces the compliance proxy with response harmfulness
Start here
On October 16, 2026, arXiv published a study proposing an optimization-based jailbreak attack method, ECHO. The method changes the optimization objective from a prompt-level compliance proxy to a continuous harmfulness score of the decoded response, scores with HarmSig, a 1.7B regressor based on actual harmful capability, and combines five word-level perturbation operators with a keyword-anchored beam search with global top-m memory, running under a strict black-box threat model. On AdvBench, against five open-weight models, ECHO achieves a maximum StrongREJECT average score of 0.898 and a HarmBench success rate of 89.23%; the code has been released.
Generated by AI from reports · Updated 25 days ago
Attention and developments
Attention, hourly
Now 36, 0% in 24 hours·Peak 36 (Nov 6 04:00)
Related research
This event's paper
- ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
arXiv · 2026-10-16 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesECHO: an optimization-based jailbreak attack that replaces the compliance proxy with response harmfulness
Researchers propose ECHO, an optimization-based jailbreak attack that changes the optimization objective from a prompt-level compliance proxy to a continuous harmfulness score of the decoded response. The method scores with HarmSig, a 1.7B regressor based on actual harmful capability, and combines five word-level perturbation operators with a keyword-anchored beam search with global top-m memory, operating under a strict black-box threat model. On AdvBench against five open-weight models, ECHO achieves a highest average StrongREJECT score of 0.898 and an 89.23% HarmBench success rate; the code is public.