RL-Tuned LLM Jailbreak

Description

LLMStinger uses a reinforcement-learning loop to fine-tune an attacker model that generates adversarial suffixes for jailbreak prompts. Because the approach does not require white-box access to the target, it can adapt existing attacks for both open- and closed-source assistants and bypass otherwise effective refusal behavior.

Examples

For defensive evaluation, pair an inert request with a generated placeholder suffix and measure whether the target changes its policy decision after suffix adaptation. The paper reports evaluations against Claude 2, Gemma 2B IT, GPT-3.5, GPT-4, Llama 2 7B Chat, and Vicuna 7B using HarmBench-derived tasks: arXiv:2411.08862 (opens in a new tab).

Impact

Automated suffix generation lowers the cost of producing transferable jailbreak attempts and can substantially increase the rate of unsafe completions across model families, undermining defenses tuned only to known, static suffixes.

Affected Systems

• Safety-aligned conversational models exposed through black-box interfaces, including the Claude, Gemma, GPT, Llama, and Vicuna variants listed in the entry metadata.

Mitigation Steps

• Test with diverse, adaptively generated suffixes and inert goals, including transfer from other model families, and keep these cases in release regressions.
• Combine model-level safety training with input and output policy checks that reason about intent rather than matching a fixed suffix signature.
• Rate-limit repeated adaptive attempts and monitor for anomalous suffix patterns without treating perplexity alone as a sufficient defense.

Evidence

Primary source: LLMStinger: Jailbreaking LLMs using RL fine-tuned LLMs (opens in a new tab).