A Single Suffix to Break Them All: Basin-Aware Jailbreaks for Merged Model Families

Yu Zhe; Yixin Tan; Junhao Wei; Wang Chen

cs.LGAug 27, 2026

A Single Suffix to Break Them All: Basin-Aware Jailbreaks for Merged Model Families

Authors: Yu Zhe, Yixin Tan, Junhao Wei, Wang Chen

Organizations: RIKEN AIP · Institute of Science Tokyo · Zhejiang University

Abstract

Model merging enables combining multiple fine-tuned models without additional training, but its safety implications remain poorly understood. Prior work primarily attributes merging risks to unsafe constituent models, implicitly assuming that merging individually aligned models preserves safety. In contrast, we show that model merging reveals a previously overlooked jailbreak risk rooted in the pretrained foundation model, even when all constituent models are individually safety-aligned. Motivated by this observation, we study a new threat setting where an attacker constructs jailbreak prompts that generalize across merged models sharing the same pretrained backbone, without access to the exact merging coefficients or constituent checkpoints. To exploit this phenomenon, we propose Basin-Aware Jailbreak (BAJ), which formulates jailbreak generation as a min--max optimization over the merging space to produce transferable adversarial suffixes across merged model families. Experiments across diverse backbones and merging settings show that BAJ achieves consistently high transfer success rates and remains effective under existing defenses.

Figures & tables

Method	Llama2-7B	Llama2-13B	Llama3-8B	DeepSeek-7B	Qwen-7B	Gemma-7B
Harmful Prompt (No Attack)	0.0	0.0	0.0	0.0	0.0	0.0
GCG	20.7	11.0	17.4	16.3	19.8	23.5
AutoDAN	10.4	3.2	19.2	77.2	55.0	26.6
TUJA	22.8	23.7	28.7	41.2	20.1	29.6
SCAV	31.2	28.6	39.8	76.8	55.4	44.7
LSGM_LILA	15.5	13.2	17.8	16.4	18.9	10.5

Table 1: Family-wise Transferability Success Rate (TSR

\uparrow

) of jailbreak attacks on merged model families. Each method generates adversarial prompts without access to the target merged models, and TSR measures the average attack success rate across multiple unseen merged models derived from the same pretrained backbone. The best result in each column is highlighted in bold.

Merge Method	Watermark	NF4	INT8	FP16
Linear	66.2	67.4	65.0	67.4
Task Arithmetic	67.4	66.7	65.2	65.8
TIES	68.6	64.8	63.2	65.4
DELLA	69.3	68.9	66.5	67.5
DARE-TIES	61.7	60.6	58.1	60.6
Model Stock	58.8	58.6	56.6	58.2

Table 2: Transferability Success Rate (TSR

\uparrow

) of BAJ under different merging methods and deployment configurations.

Defense Method	Llama2-7B	Llama3-8B	Qwen-7B
No defense	65.8	68.2	77.6
Perplexity	65.8	68.2	77.6
ICD	62.3	61.0	73.7
Self-Reminder	61.6	62.3	68.4
Safety-Tuned	63.5	65.0	72.1
Intent-FT	55.2	57.9	67.5

Table 3: Average TSR (%) of BAJ under different jailbreak defense methods. Detailed experimental settings for the evaluated defenses are provided in Appendix C.2 .

Figure 1: Cross-backbone transferability of BAJ-generated adversarial suffixes across merged model families. Each row denotes the pretrained backbone used during BAJ optimization, while each column denotes the pretrained backbone of the target merged model family.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

\theta(\alpha)=\theta_{\mathrm{pre}}+\sum_{k=1}^{K}\alpha_{k}\Delta_{k}

Appendix

Algorithm 1 Basin-Aware Jailbreak (BAJ)

Dataset	Alpaca	Dolly	CodeEvol	Codealpaca	Gsm8k
Size	20k	15k	18k	80k	8k
Task	General	General	Coding	Coding	Math

Appendix

Table 4: The information of fine-tuning dataset.

Model	Safety Alignment	Abbreviation
Llama2-7B-chat ( Touvron et al., 2023 )	SFT+RLHF	Llama2-7B
Llama2-13B-chat ( Touvron et al., 2023 )	SFT+RLHF	Llama2-13B
Llama3-8B-instruct ( Grattafiori et al., 2024 )	SFT+RLHF	Llama3-8B
Deepseek-7B-chat ( Bi et al., 2024 )	SFT+RLHF	Deepseek-7B
Qwen-7B-chat ( Bai et al., 2023 )	SFT+RLHF	Qwen-7B
Gemma-7B-it ( Team et al., 2024 )	SFT+RLHF	Gemma-7B

Appendix

Table 5: The information of pretrained LLMs.

Figure 2: The ASR of harmful requests from Advbench (without any jailbreak attacks) on both pretrained and finetuned LLMs.

Model	ASR
Llama2-7B	0.0
Llama2-13B	0.0
Llama3-8B	0.01
Deepseek-7B	0.04
Qwen-7B	0.03
Gemma-7B	0.04

Appendix

Table 6: Attack Success Rate (ASR) of harmful requests from AdvBench on merged LLMs without applying any jailbreak attacks. We construct merged models by combining any two task-specific models from a pool of five models, resulting in 10 merging combinations in total. The reported ASR values are averaged over all merging combinations.

Model	Alpaca	Dolly	CodeAlpaca	CodeEvol	GSM8K
Llama2-7B	32	41	37	45	34
Llama2-13B	31	35	29	34	30
Llama3-8B	34	33	27	36	36
Deepseek-7B	48	50	48	47	51
Qwen-7B	42	43	41	38	47
Gemma-7B	37	38	32	31	36

Appendix

Table 7: TSR (%) of BAJ on standard fine-tuned models without model merging. Columns correspond to task-specific models, and rows correspond to different pretrained backbones. The target fine-tuned models are disjoint from the surrogate merged models used during BAJ optimization.

Evaluation Tasks	Linear	Task Arithmetic	TIES	DELLA	Average
Alpaca + GSM8K	76	75	74	77	75.5
Alpaca + Dolly	68	66	56	70	65.0
Alpaca + CodeAlpaca	74	72	67	76	72.3
Alpaca + CodeEvol	70	75	73	74	73.0
GSM8K + Dolly	64	66	74	67	67.8
GSM8K + CodeAlpaca	64	61	67	64	64.0

Appendix

Table 8: TSR (%) of BAJ on Llama2-7B across all task combination splits under different model merging methods. Each row corresponds to one evaluation merged model constructed from the listed task pair, while the remaining three tasks are used to build the surrogate merged model.

Method	TSR (%)
Gradient-based Optimization
GCG	20.7
BAJ (Ours)	53.2
Mutation-based Optimization
AutoDAN	10.4
BAJ (Ours)	65.8

Appendix

Table 9: Optimization strategy comparison on Llama2-7B . TSR (%) of different jailbreak attacks using gradient-based and mutation-based optimization.

Model	Maximization	Random
Llama2-7B	65.8	32.4
Llama2-13B	61.3	35.7
Llama3-8B	68.2	39.6
DeepSeek-7B	89.1	72.1
Qwen-7B	77.6	68.8
Gemma-7B	74.8	57.2

Appendix

Table 10: Ablation on merge parameter search. TSR (%) comparison between the proposed maximization strategy and random sampling for constructing surrogate merged models.

Surrogate Tasks	Number of Surrogate Models	TSR (%)
Alpaca + CodeEvol	2	72
Alpaca + CodeEvol + GSM8K	3	73
Alpaca + CodeEvol + GSM8K + Dolly	4	69

Appendix

Table 11: TSR (%) of BAJ on Llama2-7B under surrogate merged models of varying scale and task composition. The target merged model is constructed from two unseen tasks (SAMSum and DailyDialog) not included in any surrogate.

Method	Llama2-7B	Llama3-8B	Qwen-7B
GCG (single merged surrogate)	34.0	22.0	48.4
GCG-Ensemble (3 merged surrogates)	41.6	29.8	53.1
AutoDAN (merged surrogate)	12.0	21.0	61.7
BAJ (Ours)	65.8	68.2	77.6

Appendix

Table 12: TSR (%) under matched-surrogate and matched-budget conditions. All baselines are given access to the same surrogate merged model family used by BAJ and a comparable compute budget measured in total forward passes.

Figure 3: Average time required to generate a single jailbreak prompt for different attack methods on Llama2-7b-chat , measured in seconds. Results are averaged over prompts generated for $100$ malicious instructions from the AdvBench dataset.

Category	Count	Percentage
Coherent	34	68%
Partially Coherent	16	32%
Incoherent	0	0%
Total	50	100%

Appendix

Table 13: Human evaluation results on 50 randomly sampled BAJ successful jailbreak outputs.

Defense	Llama2-7B	Llama3-8B	Qwen-7B
No defense	65.8	68.2	77.6
Best non-adaptive defense (Intent-FT)	55.2	47.4	42.4
Adaptive fine-tuning on BAJ refusal pairs	18.4	15.6	20.7

Appendix

Table 14: TSR (%) of BAJ under the adaptive defense compared with the best non-adaptive defense (Intent-FT) and the no-defense baseline.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

Asymmetric Collapse in Model Merging: When Refusal Over- writes Recognition
Jul 26, 2026Aarnav Choudhary, Matheus Fonseca Rocha, Jiwon Seo +2Language Model Safety Evaluation Task Vector Merging
UCLA · Algoverse · Purdue University +1
When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs
Aug 9, 2026Yu Ma, Hongli Shi, Jing Li +2LLM Safety Benchmarks Language Model Safety Evaluation
Google · University of New South Wales · University of Technology Sydney +2
Identically Trained Language Models Break on Different Jailbreaks
Oct 25, 2026Chi-Wei Chang, Mu-Tien Kuo, Kuan-Wei Lee +1Language Model Safety Evaluation LLM Jailbreak Attacks
Cerulean Labs · National Taiwan University, Taipei, Taiwan · National Yang Ming Chiao Tung University, Hsinchu, Taiwan

Jul 26, 2026J/K move · Enter open · S save

Asymmetric Collapse in Model Merging: When Refusal Over- writes Recognition

Aarnav Choudhary, Matheus Fonseca Rocha, Jiwon Seo, Vasu Sharma+1

UCLA · Algoverse · Purdue University+1

Language Model Safety Evaluation Task Vector Merging Language Model Merging Model Merging Refusal Behavior in Language Models

Open paper AskPDF arXiv

Model merging is often used to combine capabilities from separately fine-tuned models without additional training, but it is unclear whether standard merging methods preserve multiple safety-relevant behaviors simultaneously. We study this question through a controlled case study using two Gemma-3-1B-IT finetunes on two complementary safety objectives: CARES harm-level classification and WildJailbreak adversarial refusal. We merge the two fine-tunes using Linear, SLERP, TIES, and DARE-TIES, and evaluate the merged models on classification accuracy, attack resistance, and benign compliance. Across all four methods, attack resistance transfers significantly more than classification accuracy: merged models retain 81-85% jailbreak refusal rates while CARES accuracy falls to at most 12.9%. Weight-space measurements suggest that this asymmetry is not caused by strongly opposing task-vector directions: the two task vectors are nearly orthogonal (cosine similarity 0.011). Instead, the refusal fine-tune induces consistently larger per-layer task-vector magnitudes, causing magnitude-sensitive methods to favor refusal updates. These results show that standard model merging can collapse safety recognition into broad refusal when safety-relevant task vectors differ substantially in scale.

Abstract

Adversarial Attacks on LLMs

Explore similar work

Asymmetric Collapse in Model Merging: When Refusal Over- writes Recognition

When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs

Identically Trained Language Models Break on Different Jailbreaks