Universal Jailbreak Suffixes Are Strong Attention Hijackers
We study suffix-based jailbreaksx2013a powerful family of attacks
against large language models (LLMs) that optimize adversarial suffixes to
circumvent safety alignment. Focusing on the widely used foundational GCG
attack (Zou et al., 2023), we observe that suffixes vary in efficacy: some
markedly more universalx2013generalizing to many unseen harmful
instructionsx2013than others. We first show that GCG's
effectiveness is driven by a shallow, critical mechanism, built on the
information flow from the adversarial suffix to the final chat template tokens
before generation. Quantifying the dominance of this mechanism during
generation, we find GCG irregularly and aggressively hijacks the
contextualization process. Crucially, we tie hijacking to the universality
phenomenon, with more universal suffixes being stronger hijackers.
Subsequently, we show that these insights have practical implications: GCG
universality can be efficiently enhanced (up to times5 in some cases) at no
additional computational cost, and can also be surgically mitigated, at least
halving attack success with minimal utility loss. We release our code and data
at http://github.com/matanbt/interp-jailbreak.
685296b1a523e43c8c016658
Matan Ben-Tov
claimed_verified
2025-06-18T10:58:44.651Z
635671cdef1d4c919152b8e8
https://cdn-avatars.huggingface.co/v1/production/uploads/635671cdef1d4c919152b8e8/kXi7uO9z_Et5vbJQTWfW5.jpeg
Matan BT
user
MatanBT
685296b1a523e43c8c016659
Mor Geva
claimed_verified
2025-06-19T09:10:27.494Z
610b729f9da682cd54ad9adf
https://cdn-avatars.huggingface.co/v1/production/uploads/1628140189042-noauth.jpeg
Mor Geva
user
mega
685296b1a523e43c8c01665a
Mahmood Sharif
Universal Jailbreak Suffixes Are Strong Attention Hijackers
We study suffix-based jailbreaksx2013a powerful family of attacks
against large language models (LLMs) that optimize adversarial suffixes to
circumvent safety alignment. Focusing on the widely used foundational GCG
attack (Zou et al., 2023), we observe that suffixes vary in efficacy: some
markedly more universalx2013generalizing to many unseen harmful
instructionsx2013than others. We first show that GCG's
effectiveness is driven by a shallow, critical mechanism, built on the
information flow from the adversarial suffix to the final chat template tokens
before generation. Quantifying the dominance of this mechanism during
generation, we find GCG irregularly and aggressively hijacks the
contextualization process. Crucially, we tie hijacking to the universality
phenomenon, with more universal suffixes being stronger hijackers.
Subsequently, we show that these insights have practical implications: GCG
universality can be efficiently enhanced (up to times5 in some cases) at no
additional computational cost, and can also be surgically mitigated, at least
halving attack success with minimal utility loss. We release our code and data
at http://github.com/matanbt/interp-jailbreak.
Suffix-based jailbreaks exploit adversarial suffixes to hijack large language models, with effectiveness linked to suffix universality; the method can be enhanced and mitigated with minimal computational or utility cost.
suffix-based jailbreaks large language models adversarial suffixes safety alignment GCG attack information flow contextualization process suffix universality hijacking attack mitigation