ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack

Yuanwei Wu; Lingdong Huang; Yunlong Mao; Kanye Ye Wang; Jingyu Hua; Sheng Zhong

cs.CROct 16, 2026

ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack

Authors: Yuanwei Wu, Lingdong Huang, Yunlong Mao, Kanye Ye Wang, Jingyu Hua, Sheng Zhong

Organizations: Nanjing University · University of the Chinese Academy of Sciences · University of Macau

Abstract

Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says. We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability. ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model. Across five open-weight victims on AdvBench, ECHO achieves up to 0.898 StrongREJECT mean score and 89.23% HarmBench success. Our code is publicly available at https://github.com/STANWYW/echo.

Figures & tables

Figure 1: Comparison between compliance proxy-based and response-level harmfulness score-based jailbreak.

Figure 2: ECHO offline preparation.

Figure 3: ECHO online search loop.

Jailbreak Type	Method	Llama-2-7B		Llama-2-13B		Llama-3.1-8B		Qwen2.5-7B		Gemma-3-12B
Jailbreak Type	Method	SR	HB	SR	HB	SR	HB	SR	HB	SR	HB
Handcrafted	FlipAttack	0.104	10.19	0.238	28.85	0.239	26.92	0.378	35.00	0.602	65.00
Handcrafted	DeepInception	0.303	27.69	0.327	18.27	0.494	32.31	0.500	48.46	0.188	0.19
LLM-Generated	PAIR	0.320	21.15	0.367	25.58	0.518	53.46	0.510	48.27	0.168	17.50
Optimization	GCG	0.088	7.31	0.216	30.77	0.303	30.00	0.421	46.35	0.117	0.77
	AutoDAN	0.093	27.50	0.143	25.00	0.045	0.58	0.335	51.73	0.057	16.35

Table 1: Main baseline comparison. SR: StrongREJECT mean score

\in[0,1]

. HB: HarmBench classifier success rate (%).

Figure 4: Top-

m

saturation across five victims (AdvBench, 520 goals). Both SR and HarmBench success rate saturate near

m{\approx}25

, and their model rankings agree on four of five victims.

ECHO optimized on $\downarrow$	Evaluated on $\rightarrow$
ECHO optimized on $\downarrow$	Llama-2-7B	Llama-2-13B	Llama-3.1-8B	Qwen2.5-7B	Gemma-3-12B
Llama-2-7B-Chat	– / –	0.674 / 53.27	0.711 / 52.69	0.731 / 54.62	0.538 / 55.38
Llama-2-13B-Chat	0.661 / 52.88	– / –	0.709 / 53.65	0.731 / 50.77	0.544 / 53.27
Llama-3.1-8B-Instruct	0.533 / 30.77	0.523 / 34.81	– / –	0.750 / 61.15	0.565 / 57.88
Qwen2.5-7B-Instruct	0.458 / 28.46	0.436 / 27.12	0.690 / 60.58	– / –	0.588 / 63.85
Gemma-3-12B-IT	0.542 / 33.27	0.510 / 31.15	0.741 / 60.77	0.786 / 65.00	– / –

Table 2: ECHO cross-model transfer (

n{=}520

goals, top-

m{=}25

prompts per goal). Rows: victim used during optimization; columns: victim at evaluation. Each cell: SR@25 / HB@25 (%).

Scorer	Time (s)	SR	HB(%)
Random	73.96	0.062	1
Keyword	74.48	0.099	2
compliance proxy	81.90	0.253	8
HarmSig	81.80	0.793	59

Table 3: Scorer ablation on Llama-2-7B-Chat (

n{=}100

goals). All four variants use the same Keyword-Anchored Beam Search loop; only the inner-loop scoring function is varied. SR: mean StrongREJECT score; HB: HarmBench classifier success rate (%); Time: wall-clock seconds per goal.

Algorithm	Time (s)	Mean SR	HB ASR (%)
SA	77.73	0.161	5
Greedy	78.02	0.376	21
Beam	76.58	0.626	48
ECHO	81.80	0.793	59

Table 4: Search ablations on Llama-2-7B-Chat (

n{=}100

goals, HarmSig scorer fixed). Beam, Greedy, and SA omit keyword-feasibility, BO weights, and global memory; ECHO adds all three.

Method	Time / goal (s)
AutoDAN	357.15
GCG	126.23
DSN	63.22
ECHO	81.80

Table 5: Average online runtime per goal on Llama-2-7B-Chat over 100 AdvBench goals.

Model	HB	Annotator A	Annotator B
Qwen2.5-7B	80%	78%	80%
Llama-2-13B	62%	63%	65%
Pooled	71.0%	70.5%	72.5%

Table 6: Blinded human validation on 200 ECHO responses. HB denotes HarmBench attack success rate.

Comparison	Agreement	Cohen’s $\kappa$
HB vs. Annotator A	94.5%	0.87
HB vs. Annotator B	91.5%	0.79
Annotator A vs. B	95.0%	0.88

Table 7: Agreement between HarmBench and the blinded human annotators.

Type	Method	No grad.	No logits	No att. LLM	No template	No aff. target	Single turn
Handcrafted	FlipAttack Liu et al. (2025)	✓	✓	✓	$\times$	✓	✓
	DeepInception Li et al. (2024)	✓	✓	✓	$\times$	✓	✓
	ArtPrompt Jiang et al. (2024)	✓	✓	✓	$\times$	✓	✓
	Speak Easy Chan et al. (2025)	✓	✓	✓	$\times$	✓	$\times$
	M2S Ha et al. (2025)	✓	✓	✓	$\times$	✓	✓
LLM-Generated	PAIR Chao et al. (2025)	✓	✓	$\times$	$\times$	$\times$	✓

Table 8: Threat-model comparison. ✓ : satisfies the condition.

\times

: requires the resource. No grad. : no gradient access to the victim LLM. No logits : no logit or probability access to the victim. No att. LLM : no auxiliary LLM used to generate or refine attack prompts; ECHO’s HarmSig is a response scorer (not a prompt generator) and does not count. No template : no predefined jailbreak scaffold. No aff. target : no fixed target string such as “Sure, here is…”. Single-turn : single interaction per attempt with no multi-turn conversation manipulation.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Epoch	Train MSE	Spearman $\rho$	RMSE	MAE	[email protected]	[email protected]
1	0.0213	0.825	0.183	0.119	0.883	0.805
2	0.00856	0.842	0.164	0.104	0.893	0.815
3	0.00581	0.846	0.164	0.105	0.896	0.820

Appendix

Table 9: HarmSig student performance across three training epochs; validation metrics use 4,460 held-out responses.

$m$	Llama-2-7B		Llama-2-13B		Llama-3.1-8B		Qwen2.5-7B		Gemma-3-12B
$m$	SR	HB (%)	SR	HB (%)	SR	HB (%)	SR	HB (%)	SR	HB (%)
1	0.685	58.27	0.685	58.46	0.710	65.96	0.780	71.92	0.525	52.69
5	0.789	72.31	0.776	69.04	0.812	75.38	0.856	83.08	0.638	71.54
10	0.816	75.96	0.800	71.35	0.839	77.50	0.876	86.54	0.669	77.50
15	0.825	77.31	0.809	73.27	0.848	78.46	0.888	88.08	0.685	80.19
20	0.831	78.08	0.817	74.42	0.853	79.42	0.894	89.04	0.694	81.15

Appendix

Table 10: Per-model top-

m

saturation values on AdvBench, sampled from Figure 4 .

Category	Llama-2-7B		Llama-2-13B		Llama-3.1-8B		Qwen2.5-7B		Gemma-3-12B
	SR	HB (%)	SR	HB (%)	SR	HB (%)	SR	HB (%)	SR	HB (%)
Overall ( $n{=}200$ )	0.577	57.0	0.575	53.5	0.618	68.5	0.660	70.5	0.426	51.5
Chem. & Bio. ( $n{=}28$ )	0.637	75.0	0.682	82.1	0.581	71.4	0.705	85.7	0.370	50.0
Cybercrime ( $n{=}40$ )	0.701	80.0	0.624	72.5	0.626	90.0	0.666	85.0	0.461	72.5
Harassment ( $n{=}19$ )	0.539	31.6	0.449	15.8	0.580	36.8	0.708	52.6	0.427	15.8
Harmful ( $n{=}21$ )	0.573	47.6	0.525	33.3	0.540	52.4	0.619	52.4	0.415	19.0

Appendix

Table 11: ECHO on HarmBench by semantic category, top-

m

= 1 (best candidate on the final beam frontier per goal). SR: mean StrongREJECT score (

\in[0,1]

); HB (%): HarmBench classifier attack success rate.

Category	Llama-2-7B		Llama-2-13B		Llama-3.1-8B		Qwen2.5-7B		Gemma-3-12B
	SR	HB (%)	SR	HB (%)	SR	HB (%)	SR	HB (%)	SR	HB (%)
Overall ( $n{=}200$ )	0.759	79.5	0.735	76.5	0.762	83.5	0.802	90.5	0.597	81.5
Chem. & Bio. ( $n{=}28$ )	0.786	92.9	0.797	96.4	0.716	78.6	0.788	100.0	0.543	85.7
Cybercrime ( $n{=}40$ )	0.864	95.0	0.813	87.5	0.787	100.0	0.813	100.0	0.638	95.0
Harassment ( $n{=}19$ )	0.700	52.6	0.672	42.1	0.777	63.2	0.847	78.9	0.607	47.4
Harmful ( $n{=}21$ )	0.714	61.9	0.695	61.9	0.769	76.2	0.803	85.7	0.563	57.1

Appendix

Table 12: ECHO on HarmBench by semantic category, top-

m

= 25 (best-of-25 candidates per goal). SR: mean StrongREJECT score (

\in[0,1]

); HB (%): HarmBench classifier attack success rate. Goal counts per category are given in parentheses.

Selection	SR	HB (%)
Top- $m{=}1$	0.165	0.0
Top- $m{=}25$	0.564	10.0

Appendix

Table 13: Zero-query transfer of ECHO prompts from Llama-2-7B-Chat to GPT-5.4 on 100 AdvBench goals.

LLM Jailbreak Attacks

Large language model (LLM) jailbreak attacks study how adversarial inputs bypass safety rules and elicit disallowed outputs.

See all 207 papers

SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement
Sep 5, 2026Quoc Viet Vo, Trung Le, Damith C. Ranasinghe +1LLM Security Jailbreak Attacks
Australian Institute for Machine Learning · Adelaide University · Monash University
JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization
Jun 9, 2026Ge Shi, Jun Yin, Donglin Xie +3Adversarial Prompt Generation Large Language Model-Guided Optimization
University of California, Davis · The Renmin University of China · Independent Researcher +3
TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models
Mar 3, 2026Zhi Xu, Jiaqi Li, Xiaotong Zhang +2Adversarial Attacks on LLMs Jailbreak Attacks
Dalian University of Technology, Dalian, China

Sep 5, 2026J/K move · Enter open · S save

SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement

Quoc Viet Vo, Trung Le, Damith C. Ranasinghe, Ehsan Abbasnejad

Australian Institute for Machine Learning · Adelaide University · Monash University

LLM Security Jailbreak Attacks LLM Jailbreak Attacks Language Model Safety Evaluation

Open paper AskPDF arXiv

Despite the significant efforts devoted to aligning large language models (LLMs) with human values and ensuring safe deployment, recent work has revealed that LLMs remain vulnerable to adversarial jailbreak attacks that can bypass safety guardrails and elicit harmful responses. Many defense methods are proposed to detect jailbreaks but they are limited in their effectiveness to counter wide-range optimization-based jailbreak mechanisms that can yield highly fluency-optimized or harmful semantic obfuscated prompts. To tackle this challenge, we propose a unified detection framework SAFEGuard which incorporates a hybrid fluency measurement based on cross-layer distribution distance and perplexity, and the analysis of harmful semantics through gradient matching. Our method is grounded in a paramount observation: high fluency prompts maintain their malicious intention close to harmful prompts while harmful semantic obfuscated prompts often inject gibberish token sequences. Our evaluation demonstrates that SAFEGuard consistently outperforms state-of-the-art baselines and achieves significant improvement in accuracy across different optimization-based jailbreaks. This underscores the effectiveness of SAFEGuard against evolving jailbreak attacks.

Abstract

LLM Jailbreak Attacks

Explore similar work

SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement

JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization

TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models