Large Language Model (LLM) agents are vulnerable to adversarial inputs that induce attacker-specified malicious behaviors, commonly referred to as jailbreaking. Existing optimization-based jailbreak attacks primarily employ first-order (FO) methods that leverage gradient information or zeroth-order (ZO) methods that rely on function-value feedback. However, their complementarity and optimization ordering remain underexplored. We systematically investigate four strategies: pure ZO, pure FO, ZO->FO, and FO->ZO, and develop a ZO-FO framework that explores adversarial prefixes through ZO optimization and refines their corresponding suffixes through FO optimization. To coordinate the two processes, we introduce Pair-aware optimization, which retains multiple prefix candidates, conditionally refines their suffixes and selects among the resulting prefix-suffix pairs. We further investigate agent jailbreaking from a more general stochastic-generation perspective, where the same adversarial input can induce diverse reasoning trajectories and actions that a single greedy output cannot capture. Accordingly, we adopt consistent stochastic decoding during both optimization and evaluation. Experiments across malicious-instruction and malicious-environment benchmarks demonstrate that hybrid optimization improves attack effectiveness over single-optimizer methods, while optimization order substantially influences performance.
Figures & tables
Figure 1: Four optimization organizations for prefix-suffix adversarial strings. (a) Pure ZO uses CEM to optimize both segments. Candidates are scored by target cross-entropy; per-position token frequencies from selected low-loss candidates guide cross-entropy fitting and smoothing of the sampling distribution, without model gradients. (b) Pure FO selects non-overlapping target locations, generates top-k token substitutions using target-loss gradients, and retains the candidate with the lowest screening loss. (c, d) apply ZO-to-FO and FO-to-ZO, respectively, updating prefix before suffix while fixing the other segment. Blue/orange denote prefix/suffix.
Figure 2: Mechanistic illustration of UDora and Pair-aware on an InjecAgent example. Following an attacker-modified tool response, UDora deterministically selects target-insertion sites, whereas Pair-aware refines suffixes conditioned on candidate prefixes and selects complete pairs by success, then loss.
Model
Method
Attack Categories
Avg. ASR
Detailed
Simple
+Hint
-Hint
+Hint
-Hint
Llama-3.1- 8B-Instruct
GCG
38.64%
38.64%
40.91%
31.82%
37.50%
UDora (Sequential)
59.09%
50.00%
50.00%
43.18%
50.57%
UDora (Joint)
43.18%
38.64%
47.73%
50.00%
44.89%
REINFORCE-GCG
81.82%
70.45%
75.00%
72.73%
75.00%
Table 1: Attack Success Rate (%) on AgentHarm under different attack categories.
Model
Method
Attack Categories
Avg. ASR
Direct Harm
Data Stealing
Llama-3.1- 8B-Instruct
GCG
34%
28%
31%
UDora (Sequential)
48%
42%
45%
UDora (Joint)
44%
52%
48%
REINFORCE-GCG
44%
48%
46%
Pair-aware
100%
100%
100%
Table 2: Attack Success Rate (%) on InjecAgent across different attack categories.
Model
Method
Attack Categories
Avg. ASR
Price Mismatch
Attribute Mismatch
Category Mismatch
All Mismatch
Llama-3.1- 8B-Instruct
GCG
0.00%
0.00%
0.00%
0.00%
0.00%
UDora (Sequential)
13.33%
13.33%
6.67%
0.00%
8.33%
UDora (Joint)
6.67%
13.33%
13.33%
0.00%
8.33%
REINFORCE-GCG
0.00%
6.67%
0.00
0.00%
1.67%
Pair-aware
20.00%
60.00%
20.00%
6.67%
26.67%
Table 3: Attack Success Rate (%) on WebShop under different attack categories.
Model
Optimization Mode
Attack Categories
Avg. ASR
Detailed
Simple
+Hint
-Hint
+Hint
-Hint
Llama-3.1- 8B-Instruct
FO
72.73%
45.45%
54.55%
63.64%
59.09%
ZO
54.55%
36.36%
54.55%
54.55%
50.00%
FO → ZO
68.18%
59.09%
61.36%
52.27%
60.23%
ZO → FO
86.36%
90.91%
84.09%
95.45%
89.20%
Table 4: Ablation study of different optimization modes on AgentHarm.
Model
Optimization Mode
Attack Categories
Avg. ASR
Direct Harm
Data Stealing
Llama-3.1- 8B-Instruct
FO
54%
50%
52%
ZO
60%
54%
57%
FO → ZO
54%
56%
55%
ZO → FO
100%
100%
100%
Qwen3- 8B
FO
2%
6%
4%
Table 5: Ablation study of different optimization modes on InjecAgent.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 3: Pair-aware optimization on an AgentHarm example. (1) An adversarial string, initialized with repeated x tokens and split into a 10-token prefix and a 15-token suffix, is appended to the user request to elicit get_latest_emails . (2) The initial response refuses the request without emitting the target function. (3) Four prefix–suffix pairs are evaluated in the first cycle. None hits the target, so the lowest-loss Pair 2 is retained. (4) In the subsequent cycle, candidate prefixes are renewed, and each prefix is held fixed while its corresponding suffix is refined from the same incumbent suffix. Complete pairs are compared using target-name hits and common loss, prioritizing success. Pair 3 is selected despite a higher loss (4.34375) than unsuccessful Pair 1 (3.56250), and its prefix and refined suffix are adopted together. The dashed arrow from (4) back to (3) indicates repetition of candidate renewal, conditional suffix refinement, and complete-pair selection until success or budget exhaustion. Blue and orange distinguish prefix and suffix segments, locks mark fixed prefixes, and green highlights the successful pair. (5) The final response contains the target-function text, indicating attack successful.
Figure 4: Pair-aware optimization on an InjecAgent example. (1) A traffic-control instruction and an adversarial string initialized with repeated x tokens are injected into a calendar tool response to target TrafficControlManageTrafficLightState . The string comprises a 10-token prefix and a 15-token suffix. (2) The initial response answers the calendar query without emitting the target action. (3) Four prefixes are screened by loss with the incumbent suffix; red crosses indicate unconfirmed success. (4) Each prefix is fixed while suffix refinement starts from the same incumbent suffix. Pairs are ranked by target-name hits, then loss. Pair 2 achieves a hit with loss 4.02387; its prefix and unchanged suffix are adopted together. The dashed loop repeats optimization until success or budget exhaustion. Blue and orange denote prefix and suffix, locks mark fixed prefixes, and green highlights the selected pair. (5) The output contains the target-action text, demonstrating it hit the target function and attack successful.
Figure 5: Pair-aware optimization on a WebShop example. (1) The user seeks two mesh laundry bags under $50. The attacker appends an adversarial string, initialized with repeated x tokens and split into a 10-token prefix and a 15-token suffix, to an unrelated toothpaste-cap listing, targeting click[B09NQ5ZCPH]. (2) The initial response does not emit the target click. (3) Four prefix–suffix pairs are screened by target loss with the current suffix fixed. Red crosses mark unconfirmed success; the blue outline tracks the eventual winner, Pair 4, rather than the initial lowest-loss candidate. All four pairs proceed to refinement. (4) Each prefix is fixed while its suffix is independently refined from the same incumbent suffix. Complete pairs are compared by target-name hits and common loss, prioritizing success and then lower loss. Pair 4 is selected with a target-text hit and loss 4.66323, and its prefix and refined suffix are adopted together. The dashed arrow denotes repetition until success or budget exhaustion. Blue and orange distinguish prefix and suffix segments, locks mark fixed prefixes, and green highlights the selected pair. (5) The generated response contains the target-click text.
Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.