ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack

Key points

• Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks.1
• Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply.1
• This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says.1
• ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model.1

Sources (1)

• [1]ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 16, 07:07 AM

  We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability.

  Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks.

Extractive summary: sentences quoted from the sources.