cs.CRMar 20, 2026

Evolving Jailbreaks: Automated Multi-Objective Long-Tail Attacks on Large Language Models

Authors: Wenjing Hong, Zhonghua Rong, Li Wang, Feng Chang, Jian Zhu, Ke Tang, Zexuan Zhu, Yew-Soon Ong

Organizations: School of Artificial Intelligence Shenzhen Univeristy, China · Brain-Inspired Technology Co.,Ltd, China · Department of Computer Science and Engineering Southern University of Science and Technology, China · College of Computing & Data Science Nanyang Technological University, Singapore

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Large Language Models (LLMs) have been widely deployed, especially through free Web-based applications that expose them to diverse user-generated inputs, including those from long-tail distributions such as low-resource languages and encrypted private data. This open-ended exposure increases the risk of jailbreak attacks that undermine model safety alignment. While recent studies have shown that leveraging long-tail distributions can facilitate such jailbreaks, existing approaches largely rely on handcrafted rules, limiting the systematic evaluation of these security and privacy vulnerabilities. In this work, we present EvoJail, an automated framework for discovering long-tail distribution attacks via multi-objective evolutionary search. EvoJail formulates long-tail attack prompt generation as a multi-objective optimization problem that jointly maximizes attack effectiveness and minimizes output perplexity, and introduces a semantic-algorithmic solution representation to capture both high-level semantic intent and low-level structural transformations of encryption-decryption logic. Building upon this representation, EvoJail integrates LLM-assisted operators into a multi-objective evolutionary framework, enabling adaptive and semantically informed mutation and crossover for efficiently exploring a highly structured and open-ended search space. Extensive experiments demonstrate that EvoJail consistently discovers diverse and effective long-tail jailbreak strategies, achieving competitive performance with existing methods in both individual and ensemble level.

Figures & tables

Figure 1: Overall framework of EvoJail. It employs an evolutionary multi-objective search framework that jointly balances attack effectiveness (ASR) and harmful output quality (PPL). The framework constructs the search space by combining semantic information and algorithmic descriptions, and incorporates LLM-assisted operators (including initialization, mutation, crossover, and repair operators) to enhance the search process. A diverse set of encryption-decryption prompt pairs representing a Pareto front of attack strategies is generated to support flexible application.
Figure 2: An example of an encryption-decryption scheme.
Figure 3: The initialization prompt.
Figure 4: The key of the mutation and crossover prompt.
Figure 5: The key of the repair prompt.
Model-ScenarioFlipAttackCodeChameleonCodeAttackJailbrokenCipherReNeLLMEvoJail
LLaMA7B-G10.0490.3090.0490.2610.0000.1780.524
LLaMA7B-G20.0470.3550.0420.2360.0000.1630.670
LLaMA7B-G30.0640.4470.0500.3520.0000.1700.665
LLaMA8B-G10.3580.4370.6200.4150.0650.4660.708
LLaMA8B-G20.3720.5000.5950.5000.0200.5250.770
LLaMA8B-G30.4220.4940.5620.4610.1110.5880.696
Table 1: Performance in terms of the hypervolume metric. The shaded entries indicate the best performance.
Figure 6: Visualization of the Pareto fronts of all algorithms in the attack effectiveness and output perplexity objective space.
Figure 7: Response comparison between EvoJail and baselines for jailbreak on LLAMA-7B-G.
Figure 8: Response comparison between EvoJail and baselines for jailbreak on LLAMA-7B-G.
Model-DatasetFlipAttackCodeChameleonCodeAttackJailbrokenCipherReNeLLMEvoJail
LLaMA-7B-G0.0570.3400.0590.3400.0000.1750.762
LLaMA-7B-J0.0540.2020.0580.3150.0000.1520.709
LLaMA-8B-G0.4950.6140.7390.6570.0000.4870.790
LLaMA-8B-J0.4450.5110.7150.5840.0000.4540.756
GPT-G0.2000.6160.6880.0000.0000.1720.676
GPT-J0.1140.4190.6100.0000.0000.0530.549
Table 2: Performance in terms of the hypervolume metric at the ensemble level on unseen instances.
Figure 9: Visualization of the ensemble-level performance of all algorithms on unseen instances.
Figure 10: Visualization of the ensemble-level performance of all algorithms. EvoJail is shown with different ensemble sizes.
Figure 11: The evolutionary performance of EvoJail at the ensemble level.
More in this topic

Jailbreak Attacks

Jailbreak attacks exploit prompts, context, or model representations to bypass AI safeguards and elicit disallowed outputs.

See all 75 papers

Explore similar work

CardsList
Mar 3, 2026

TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

Large language models (LLMs) have achieved remarkable success across diverse applications but remain vulnerable to jailbreak attacks, where attackers craft prompts that bypass safety alignment and elicit unsafe responses. Among existing approaches, optimization-based attacks have shown strong effectiveness, yet current methods often suffer from frequent refusals, pseudo-harmful outputs, and inefficient token-level updates. In this work, we propose TAO-Attack, a new optimization-based jailbreak method. TAO-Attack employs a two-stage loss function: the first stage suppresses refusals to ensure the model continues harmful prefixes, while the second stage penalizes pseudo-harmful outputs and encourages the model toward more harmful completions. In addition, we design a direction-priority token optimization (DPTO) strategy that improves efficiency by aligning candidates with the gradient direction before considering update magnitude. Extensive experiments on multiple LLMs demonstrate that TAO-Attack consistently outperforms state-of-the-art methods, achieving higher attack success rates and even reaching 100% in certain scenarios.

Zhi Xu, Jiaqi Li, Xiaotong Zhang +2

Dalian University of Technology, Dalian, China

Adversarial Attacks on LLMsJailbreak AttacksLLM Jailbreak Attacks
AskPDF
May 18, 2026

Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling

Despite rigorous safety alignment, Large Language Models (LLMs) remain vulnerable to jailbreak attacks. Existing black-box methods often rely on heuristic templates or exhaustive trials, lacking mechanistic interpretability and query efficiency. In this study, we investigate an intrinsic vulnerability in the safety mechanisms of LLMs, where safety alignment relies on a small set of sparsely distributed attention heads, leaving much of the representational space weakly monitored. We formalize this phenomenon with a mathematical jailbreaking model that characterizes the delicate boundary of effective text obfuscation and analytically explains observed jailbreak behaviors. Guided by this model, we propose Babel, an efficient black-box attack framework that exploits the identified safety gap through systematic obfuscation sampling with iterative, feedback-driven distribution refinement, enabling reliable and high-success jailbreak attacks without access to model internals. Comprehensive evaluations on frontier commercial models demonstrate that Babel achieves state-of-the-art attack success rates and superior query efficiency. Specifically, compared to state-of-the-art methods, Babel increases the attack success rate on GPT-4o from 41.33% to 82.67% and on Claude-3-5-haiku from 38.33% to 78.33% within an average of 40 queries, providing a robust red-teaming methodology for LLMs safety research.

Ziwei Wang, Jing Chen, Ruichao Liang +6

Wuhan University · Nanyang Technological University · Southeast University +1

LLM SafetyLLM Jailbreak AttacksAttention MechanismsBlack-Box Adversarial AttacksAdversarial Text Attacks
AskPDF
May 6, 2026

SoK: Robustness in Large Language Models against Jailbreak Attacks

Large Language Models (LLMs) have achieved remarkable success but remain highly susceptible to jailbreak attacks, in which adversarial prompts coerce models into generating harmful, unethical, or policy-violating outputs. Such attacks pose real-world risks, eroding safety, trust, and regulatory compliance in high-stakes applications. Although a variety of attack and defense methods have been proposed, existing evaluation practices are inadequate, often relying on narrow metrics like attack success rate that fail to capture the multidimensional nature of LLM security. In this paper, we present a systematic taxonomy of jailbreak attacks and defenses and introduce Security Cube, a unified, multi-dimensional framework for comprehensive evaluation of these techniques. We provide detailed comparison tables of existing attacks and defenses, highlighting key insights and open challenges across the literature. Leveraging Security Cube, we conduct benchmark studies on 13 representative attacks and 5 defenses, establishing a clear view of the current landscape encompassing jailbreak attacks, defenses, automated judges, and LLM vulnerabilities. Based on these evaluations, we distill critical findings, identify unresolved problems, and outline promising research directions for enhancing LLM robustness against jailbreak attacks. Our analysis aims to pave the way towards more robust, interpretable, and trustworthy LLM systems. Our code is available at Code.

Feiyue Xu, Hongsheng Hu, Chaoxiang He +9

Shanghai Jiao Tong University, China · Microsoft Corporation

Language Model Safety EvaluationLLM SecurityLLM Jailbreak AttacksAdversarial Robustness of Language ModelsJailbreak Defense
AskPDF