TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

Zhi Xu; Jiaqi Li; Xiaotong Zhang; Hong Yu; Han Liu

cs.CLMar 3, 2026

TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

Authors: Zhi Xu, Jiaqi Li, Xiaotong Zhang, Hong Yu, Han Liu

Organizations: Dalian University of Technology, Dalian, China

Abstract

Large language models (LLMs) have achieved remarkable success across diverse applications but remain vulnerable to jailbreak attacks, where attackers craft prompts that bypass safety alignment and elicit unsafe responses. Among existing approaches, optimization-based attacks have shown strong effectiveness, yet current methods often suffer from frequent refusals, pseudo-harmful outputs, and inefficient token-level updates. In this work, we propose TAO-Attack, a new optimization-based jailbreak method. TAO-Attack employs a two-stage loss function: the first stage suppresses refusals to ensure the model continues harmful prefixes, while the second stage penalizes pseudo-harmful outputs and encourages the model toward more harmful completions. In addition, we design a direction-priority token optimization (DPTO) strategy that improves efficiency by aligning candidates with the gradient direction before considering update magnitude. Extensive experiments on multiple LLMs demonstrate that TAO-Attack consistently outperforms state-of-the-art methods, achieving higher attack success rates and even reaching 100% in certain scenarios.

Figures & tables

Figure 1: Comparison of optimization-based jailbreak attacks. GCG and MAC can result in refusals, while $\mathcal{I}$ -GCG reduces refusals but produces pseudo-harmful outputs. Our TAO-Attack employs a two-stage loss to suppress refusals and penalize pseudo-harmful outputs, leading to more effective harmful completions.

Figure 2: Illustration of the token optimization. GCG prefers $\mathbf{e}_{j}$ due to its large step size, even though it deviates from the negative gradient direction (red arrow). Our method instead selects $\mathbf{e}_{l}$ , which achieves both strong alignment with the negative gradient and a sufficient step size.

Method	Vicuna-7B-1.5	Llama-2-7B-chat	Mistral-7B-Instruct-0.2
GCG ( Zou et al., 2023 )	98 %	54%	92 %
MAC ( Zhang and Wei, 2025 )	100%	56%	94%
AutoDAN ( Liu et al., 2024a )	100%	26%	96%
Probe-Sampling ( Zhao et al., 2024 )	100%	56%	94%
AmpleGCG ( Liao and Sun, 2024 )	66%	28%	-
AdvPrompter* ( Paulus et al., 2024 )	64%	24%	74%

Table 1: Attack success rates of baseline jailbreak methods and TAO-Attack on AdvBench. Results marked with * are taken from the original papers.

Method	Llama-2-7B-Chat		Mistral-7B-Instruct-0.2		Qwen2.5-7B-Instruct
Method	ASR	Iterations	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG ( Jia et al., 2025 )	68%	604	80 %	406	100%	66
TAO-Attack	92%	305	100%	86	100%	21

Table 2: Comparison of TAO-Attack and

\mathcal{I}

-GCG under fixed suffix initialization. All methods run for up to 1,000 iterations per query. Bold numbers indicate the best results.

Model	Method	GPT3.5 Turbo	GPT4 Turbo	Gemini 1.5	Gemini 2
Vicuna-7B-1.5	GCG ( Zou et al., 2023 )	30%	0%	4%	0%
	$\mathcal{I}$ -GCG ( Jia et al., 2025 )	30%	0%	0%	4%
	TAO-Attack	82%	8%	6%	4%

Table 3: Transferability evaluation of universal jailbreak suffixes optimized on Vicuna-7B-1.5.

Figure 3: Average loss for GCG (Softmax) and DPTO, with shaded areas indicating standard deviation, computed over samples where both methods succeed.

Stage One	Stage Two	DPTO	GCG (Softmax)	GCG	Harmful Guidance	ASR	Iterations
				✓	✓	55%	702
			✓		✓	55%	687
		✓			✓	65%	620
✓		✓				100%	261
✓	✓	✓				100%	243

Table 4: Ablation and component analysis of TAO-Attack. The last row presents the full method.

Method	0.8		0.9		1.0
Method	ASR	Iterations	ASR	Iterations	ASR	Iterations
Qwen3-Embedding-0.6B	95%	325	95%	273	100%	263
Rouge-L	100%	262	100%	255	100%	243

Table 5: Comparing different switching mechanisms on Llama-2-7B-Chat.

Model	Llama-2-7B-Chat		Qwen2.5-7B-Instruct		Qwen2.5-VL-7B-Instruct
Model	ASR	Iterations	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG	45%	792	100%	26	90%	248
TAO-Attack	90%	357	100%	11	95%	132

Table 6: Comparison across additional datasets and models.

Method	$\mathcal{I}$ -GCG	Stage One	Stage Two
Peak Allocated Memory (GB)	32.99	34.80	35.99
Time per iteration (s)	5.7	6.1	7.1

Table 7: Comparison of peak GPU memory and per-iteration time for

\mathcal{I}

-GCG and TAO-Attack.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Evaluation prompt for GPT-4-based (GPT-4 Turbo) checking.

Figure 5: The universal jailbreaking suffix prompts response generation from GPT-3.5 Turbo (left) and GPT-4 Turbo (right) on the OpenRouter platform.

Method	PAT ( Mo et al., 2024 )		RPO ( Zhou et al., 2024 )
Method	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG	60 %	257	86%	133
TAO-Attack	80 %	138	92%	71

Appendix

Table 8: Jailbreak performance under advanced defense methods. The number in bold indicates the best jailbreak performance.

Method	CAA ( Rimsky et al., 2024 )	SCANS ( Cao et al., 2025 )
Original	99%	94%
$\mathcal{I}$ -GCG	90%	4%
TAO-Attack	41%	0%

Appendix

Table 9: Jailbreak performance against CAA and SCANS defenses. The number in bold indicates the best attack performance.

	$\tau$			$\alpha$			$\beta$			$\gamma$
	0.8	0.9	1	0.1	0.2	0.3	0.1	0.2	0.3	0.4	0.5	0.6
ASR	100%	100%	100%	95%	100%	95%	100%	100%	100%	95%	100%	95%
Iterations	262	255	243	285	243	221	264	243	257	268	243	291

Appendix

Table 10: Hyperparameter study of the Rouge-L threshold

\tau

, stage-one weight

\alpha

, stage-two weight

\beta

, and temperature

\gamma

under the Llama-2-7B-Chat threat model.

Method	Information Extraction		Influence Operations
Method	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG	100%	36	100%	16
TAO-Attack	100%	29	100%	9

Appendix

Table 11: Comparison of attack performance for TAO-Attack and

\mathcal{I}

-GCG in security-sensitive scenarios. Bold numbers indicate the best performance.

Metric	”@ @ …@”		”# # …#”		”! ! …!”
Metric	ASR	Iterations	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG	65%	611	60%	666	65%	582
TAO-Attack	95%	201	90%	326	100%	243

Appendix

Table 12: Comparison of performance across different suffixes. Bold numbers indicate the best performance.

K	1		3		5		7
K	ASR	Iterations	ASR	Iterations	ASR	Iterations	ASR	Iterations
Llama-2-7B-Chat	95%	242	100%	243	100%	250	90%	360
Vicuna-7B-v1.5	100%	21	100%	17	100%	18	100%	18

Appendix

Table 13: Effect of the refusal set size

K

on Llama-2-7B-Chat and Vicuna-7B-v1.5. Bold numbers indicate the best performance.

Method	Original		DPTO
Method	ASR	Iterations	ASR	Iterations
GCG	55%	702	65%	620
$\mathcal{I}$ -GCG	65%	582	75%	496

Appendix

Table 14: Effect of applying DPTO to GCG and

\mathcal{I}

-GCG. Bold numbers indicate the best performance.

Method	Llama-2-13B-Chat		Vicuna-13B
Method	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG	53%	704	73%	600
TAO-Attack	67%	569	100%	82

Appendix

Table 15: Evaluation of

\mathcal{I}

-GCG and TAO-Attack on 13B-scale models. Bold numbers indicate the best performance.

Variant	ASR	Iterations
$\mathcal{I}$ -GCG	65%	582
TAO-Attack	100%	243
TAO-Attack + harmful-guidance prefix	65%	716
TAO-Attack + multi-coordinate updating	85%	325

Appendix

Table 16: Ablation on integrating components of

\mathcal{I}

-GCG into TAO-Attack. Bold numbers indicate the best performance.

Method	Non-reasoning		Reasoning-enabled
Method	ASR	Iterations	ASR	Iterations
$\mathcal{I}$ -GCG	100%	49	90%	92
TAO-Attack	100%	39	90%	79

Appendix

Table 17: Results on Qwen3-8B under different settings.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization
Jun 9, 2026Ge Shi, Jun Yin, Donglin Xie +3Adversarial Prompt Generation Large Language Model-Guided Optimization
University of California, Davis · The Renmin University of China · Independent Researcher +3
SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement
Sep 5, 2026Quoc Viet Vo, Trung Le, Damith C. Ranasinghe +1LLM Security Jailbreak Attacks
Australian Institute for Machine Learning · Adelaide University · Monash University
Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling
May 18, 2026Ziwei Wang, Jing Chen, Ruichao Liang +6LLM Safety LLM Jailbreak Attacks
Wuhan University · Nanyang Technological University · Southeast University +1

Jun 9, 2026J/K move · Enter open · S save

JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization

Ge Shi, Jun Yin, Donglin Xie, Fangyi Liu+2

University of California, Davis · The Renmin University of China · Independent Researcher+3

Adversarial Prompt Generation Large Language Model-Guided Optimization LLM Jailbreak Attacks

Open paper AskPDF arXiv

Jailbreak attacks expose persistent safety weaknesses in large language models (LLMs), but existing stateless single-turn methods face a trade-off: hand-crafted prompts are expressive but static, while iterative prompt optimization can adapt but often relies on low-level mutations that require many target queries. We propose JailbreakOPT, a tool-assisted framework for improving iterative single-turn jailbreak prompt optimization. JailbreakOPT organizes diverse atomic jailbreak prompts into an attack tool library and composes them through a unified intra-episode optimization abstraction to generate stronger standalone attack prompts. To reuse experience across attack episodes, JailbreakOPT further frames tool selection as a contextual bandit problem and applies contextual Thompson sampling to guide exploration and exploitation based on past outcomes. Experiments across multiple target LLMs and attack goals show that JailbreakOPT improves attack success rate (ASR) while reducing the number of attacks until success (No.A) compared with atomic single-turn attacks and existing iterative optimization baselines. This paper may contain offensive or harmful content.

Abstract

Adversarial Attacks on LLMs

Explore similar work

JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization

SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement

Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling